SSD Advisory – TerraMaster Operating System (TOS) File Disclosure

Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom

Vulnerability Summary
The following advisory describes a File Disclosure vulnerability found in TerraMaster Operating System (TOS) version 3.

TerraMaster Operating System, TOS is a Linux platform-based operating system developed for TerraMaster cloud storage NAS server. TOS 3 is the third generation operating system newly launched.

Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor response
TerraMaster has released patches to address this vulnerability – “Tech team limit the normal user’s rights”.

Vulnerability Details
The TerraMaster Operating System is vulnerable to a file disclosure vulnerability.

The vulnerability can be found in “index.php” file. When calling it with the parameters “explorer/fileProxy&path=” any authenticated user can download any file found in the system.

Proof of Concept
An attacker that is logged in to the remote NAS, can by sending the following request download the /etc/shadow file:

As can be seen below, in response, the TerraMaster Operating System will send the /etc/shadow file to the attacker: