KnowSafe 安全预警：TerraMaster TOS < 4.2.07 未授权远程代码执行漏洞

KnowSafe 安全预警：KnowSafe 安全团队监测到编号 AVD-2020-35665 的安全漏洞（危害等级：严重）已公开披露，相关用户应尽快排查并完成修复。

漏洞介绍

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.

影响范围

系统：terra-master terramaster_operating_system（影响面 Up to (including) 4.2.06）

解决方案

升级至安全版本4.2.07。

参考信息

http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html

https://www.exploit-db.com/exploits/49330

https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/

https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html

KnowSafe 将持续跟踪该漏洞的利用情况与修复进展，如需漏洞管理与应急响应支持，欢迎联系 KnowSafe 安全团队。