# CVE-2022-24990: TerraMaster TOS unauthenticated remote command execution via PHP Object Instantiation

Unauthenticated webNasIPS endpoint leaks admin password hash and MAC, enabling forged request signatures and OS command injection in createRaid for root RCE on TerraMaster TOS.

- Payout: Research
- Severity: critical
- Program: TerraMaster TOS
- Credited: PWNAI Research
- Disclosed: 2022-03-07
- CVE: CVE-2022-24990, CVE-2022-24989
- Write-up quality: 8/10
- Original: https://pwn.ai/blog/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation
- Tags: domain:web impact:data-leak impact:rce kind:research platform:research sev:critical technique:chained technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:command-injection vuln:info-disclosure vuln:rce

**Target:** TerraMaster NAS TOS 4.2.29 PHP web API (module/api.php, mobile.class.php)
**Root cause:** webNasIPS is whitelisted in NO_LOGIN_CHECK, $notCheck and $notHeader, exposing REQUESTCODE (admin password hash) and eth0 MAC unauthenticated; createRaid passes raidtype unsanitized into popen via volume_make_from_disks/_backexec.
**Steps:**
1. Download TOS package, binwalk-extract, decrypt PHP; read /usr/www/module/api.php router and NO_LOGIN_CHECK array
2. Identify mobile.class.php $notCheck/$notHeader; webNasIPS is in both plus NO_LOGIN_CHECK
3. `curl -H 'User-Agent: TNAS' 'http://target/module/api.php?mobile/webNasIPS'` to leak REQUESTCODE (admin hash) and gateway MAC
4. Trigger any failing call e.g. `curl 'http://target/module/api.php?mobile/createRaid'` to read `ctime` machine time
5. Reverse php_terra_master.so: tos_encrypt_str = md5(last 3 MAC bytes hex + input); compute SIGNATURE for chosen TIMESTAMP
6. Compute epoch TIMESTAMP aligned to target clock within 300s
7. Send `curl -H 'User-Agent: TNAS' -H 'AUTHORIZATION: <REQUESTCODE>' -H 'TIMESTAMP: <ts>' -H 'SIGNATURE: <hash>' -d 'raidtype=;id>/tmp/a.txt;&diskstring=X' 'http://target/module/api.php?mobile/createRaid'`
**How found:** Extracted and decrypted TOS PHP, read api.php router and whitelist arrays, cross-referenced mobile.class.php $notCheck/$notHeader to find webNasIPS passes all checks; noticed REQUESTCODE leak, then found createRaid in NO_LOGIN_CHECK but not $notHeader, traced raidtype into popen; reversed custom extension to reproduce signature.
**Exploitation:** Unauthenticated attacker leaks admin password hash and MAC via webNasIPS, leaks machine time via error ctime, forges TIMESTAMP/SIGNATURE using reversed tos_encrypt_str, then injects shell metacharacters in raidtype POST param reaching popen in _backexec, executing commands as root.
**Escalation:** Chains info leak (CVE-2022-24990) to bypass auth/signature checks, then command injection (CVE-2022-24989) for root RCE.
**Insight:** When a router whitelists methods across multiple arrays, intersect the whitelists: a method present in every bypass list (NO_LOGIN_CHECK, $notCheck, $notHeader) is the unauthenticated entry point, and its output often leaks the secret needed to satisfy the remaining header checks.