CVE-2023-48185
📋 TL;DR
This CVE describes a directory traversal vulnerability in TerraMaster NAS devices that allows remote attackers to access sensitive files outside the intended directory structure via crafted GET requests. Attackers can potentially read configuration files, credentials, or other sensitive data. All TerraMaster NAS devices running affected software versions are vulnerable.
💻 Affected Systems
- TerraMaster NAS devices
📦 What is this software?
Terra Master by Terra Mater
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through credential theft, configuration file access leading to lateral movement, or sensitive data exfiltration.
Likely Case
Unauthorized access to sensitive files containing configuration data, credentials, or user information.
If Mitigated
Limited impact with proper network segmentation, access controls, and monitoring in place.
🎯 Exploit Status
Directory traversal vulnerabilities typically have low exploitation complexity. The vulnerability requires only crafted HTTP GET requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v.2.295
Vendor Advisory: https://forum.terra-master.com/cn/viewtopic.php?f=100&t=3842
Restart Required: Yes
Instructions:
1. Log into TerraMaster TOS web interface. 2. Navigate to Control Panel > General Settings > Update & Restore. 3. Check for updates and install the latest version. 4. Reboot the NAS device after update completes.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to TerraNAS web interface to trusted networks only
Configure firewall rules to allow only specific IP ranges to access TerraNAS web ports (typically 80/443)
Web Application Firewall
allImplement WAF rules to block directory traversal patterns
Add WAF rule to block requests containing '../', '..\', or similar traversal patterns
🧯 If You Can't Patch
- Implement strict network segmentation to isolate TerraMaster NAS from untrusted networks
- Deploy a reverse proxy with request filtering to block directory traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check current TOS version in Control Panel > General Settings > Update & Restore. If version is between v.s1.0 and v.2.295 inclusive, the system is vulnerable.Check Version:
Not applicable - version check must be done through TOS web interfaceVerify Fix Applied:
Verify TOS version is greater than v.2.295. Test with controlled directory traversal attempts (if authorized) to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests containing '../' or '..\' patterns in web server logs
- Multiple failed attempts to access restricted paths
Network Indicators:
- Unusual patterns of HTTP requests to TerraMaster web interface from external IPs
- Requests attempting to access known sensitive file paths
SIEM Query:
source="terramaster_web_logs" AND (http_method="GET" AND (url="*../*" OR url="*..\\*"))