CVE-2020-35665
CRITICAL EXPLOITED IN THE WILDTerraMaster Operating System <= 4.2.06 - Unauthenticated Remote Code Execution via Event Parameter in makecvs.php
Title source: llmExploitation Summary
CVE-2020-35665 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 3 public exploits from researchers including AkkuS, including a Metasploit module exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.06 via command injection in the 'Event' parameter of 'include/makecvs.php'. It uploads a PHP shell and executes commands.
Description
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.
Exploits (3)
This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.06 via command injection in the 'Event' parameter of 'include/makecvs.php'. It uploads a PHP shell and executes commands.
This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS via shell metacharacter injection in the Event parameter of the makecvs.php endpoint. It uploads a webshell and executes commands under the context of the web application, typically running as root.
This repository contains a functional Metasploit module for CVE-2020-35665, targeting TerraMaster NAS devices with an unauthenticated RCE vulnerability. The module is part of a larger collection of private Metasploit modules, including detailed installation and usage instructions.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H