CVE-2021-45842
📋 TL;DR
This vulnerability in Terramaster NAS devices allows unauthenticated attackers to retrieve sensitive information including the first administrator's password hash, MAC address, and internal IP address via a specific API endpoint. It affects Terramaster F4-210 and F2-210 devices running TOS 4.2.X up to version 4.2.15-2107141517. This information disclosure could facilitate further attacks against the system.
💻 Affected Systems
- Terramaster F4-210
- Terramaster F2-210
📦 What is this software?
Tos by Terra Master
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain administrator credentials, gain full control of the NAS, access sensitive data, and potentially pivot to other network systems.
Likely Case
Attackers harvest administrator password hashes for offline cracking, then gain administrative access to the NAS to steal or encrypt data.
If Mitigated
Limited to information disclosure only if strong unique passwords are used and the NAS is isolated from critical systems.
🎯 Exploit Status
Exploitation requires only a simple HTTP GET request to the vulnerable endpoint. The referenced blog posts demonstrate the attack technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TOS versions after 4.2.15-2107141517
Vendor Advisory: Not publicly documented in vendor advisory
Restart Required: Yes
Instructions:
1. Log into Terramaster TOS web interface. 2. Navigate to Control Panel > General Settings > Update & Restore. 3. Check for available updates. 4. Install the latest TOS version. 5. Reboot the NAS after update completes.
🔧 Temporary Workarounds
Block API Endpoint
linuxUse web server or firewall rules to block access to the vulnerable /module/api.php endpoint
# Example iptables rule: iptables -A INPUT -p tcp --dport 80 -m string --string "/module/api.php" --algo bm -j DROP
# Example iptables rule: iptables -A INPUT -p tcp --dport 443 -m string --string "/module/api.php" --algo bm -j DROP
Network Segmentation
allIsolate Terramaster NAS devices from untrusted networks and limit access to trusted IPs only
# Example firewall rule: iptables -A INPUT -p tcp --dport 80,443 -s trusted_ip_range -j ACCEPT
# Example firewall rule: iptables -A INPUT -p tcp --dport 80,443 -j DROP
🧯 If You Can't Patch
- Change all administrator passwords to strong, unique passwords that are resistant to hash cracking
- Disable web interface access from untrusted networks and implement strict network access controls
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[NAS_IP]/module/api.php?mobile/wapNasIPS and check if it returns sensitive information including admin hashCheck Version:
Check TOS version in web interface: Control Panel > General Settings > System InformationVerify Fix Applied:
After patching, the same request should return an error or no sensitive data. Verify TOS version is newer than 4.2.15-2107141517📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /module/api.php?mobile/wapNasIPS in web server logs
- Unusual authentication attempts following information disclosure
Network Indicators:
- HTTP requests to the vulnerable endpoint from unexpected sources
- Subsequent authentication attempts using cracked credentials
SIEM Query:
source="web_logs" AND uri="/module/api.php" AND query_string="mobile/wapNasIPS"