CVE-2022-24990

What it actually does

TerraMaster NAS versions 4.2.29 and earlier expose an unauthenticated password-disclosure flaw in the web API. A remote attacker can send a request to module/api.php?mobile/webNasIPS with the HTTP header User-Agent: TNAS and receive a response containing the administrative password in the PWD field. The flaw requires no authentication, no user interaction, and is network exploitable; by itself it primarily compromises confidentiality, but the recovered administrator credential can enable full administrative access and can be chained with other TerraMaster OS vulnerabilities for command execution or ransomware deployment.

Why it matters to the business

An internet-exposed vulnerable NAS can have its administrator password disclosed to any remote attacker, creating a direct path to data theft, service disruption, destructive changes, and ransomware. This issue is listed in CISA KEV, has been observed in active exploitation, is associated with ransomware activity, and had a CISA remediation due date of 2023-03-03, so any remaining exposure should be treated as urgent. Because NAS appliances often store backups, file shares, and business-critical documents, compromise can affect recovery capability as well as normal operations.

How an attack unfolds

An attacker scans for TerraMaster NAS web interfaces, typically on exposed HTTP or HTTPS management ports. After identifying a candidate device, the attacker sends an unauthenticated HTTP request to module/api.php?mobile/webNasIPS while setting the User-Agent header to TNAS. On vulnerable versions, the API response includes a PWD field containing the administrator password. The attacker then uses that password to authenticate to the NAS management interface or other enabled services. After login, the attacker can enumerate shares, download sensitive files, change configuration, create persistence, disable services, delete or encrypt data, and potentially chain the access with TerraMaster OS remote command execution techniques. Because this vulnerability is known to be exploited in ransomware activity, post-compromise behavior may include mass file encryption, ransom notes, backup deletion, and attempts to spread through accessible network shares.

How to fix it

Upgrade TerraMaster NAS appliances running 4.2.29 or earlier to a vendor-fixed TerraMaster OS release and rotate all administrator and local user passwords after patching, because credentials may already have been exposed. Do not expose NAS management interfaces directly to the internet; restrict access using VPN, firewall allowlists, or a dedicated management network. Disable unnecessary services, review remote access settings, and enforce strong unique credentials. If compromise is suspected, rebuild or factory-reset the appliance from trusted media where feasible, restore data from known-good backups, and rotate any credentials stored on or reused with the NAS. The supplied package inventory also references libjettison-java fixed versions; where organizational vulnerability management maps this CVE to those downstream packages, apply the relevant OS security updates: Debian 11 libjettison-java 1.5.3-1~deb11u1, Debian 12/13/14 libjettison-java 1.5.1-1, Ubuntu Pro 16.04 LTS libjettison-java 1.2-3ubuntu0.1~esm1, Ubuntu Pro 18.04 LTS libjettison-java 1.4.0-1ubuntu0.18.04.1~esm1, Ubuntu 20.04 LTS libjettison-java 1.4.0-1ubuntu0.20.04.1, and Ubuntu 22.04 LTS libjettison-java 1.4.1-1ubuntu0.22.04.1.

How to confirm the fix worked

Confirm that no TerraMaster NAS appliance is running TerraMaster OS 4.2.29 or earlier. Verify from the management UI or vendor-supported CLI that the installed firmware is a fixed release. From an authorized test host, request /module/api.php?mobile/webNasIPS with User-Agent: TNAS and confirm that the response does not disclose a PWD field or administrative password. Check perimeter exposure with external attack-surface scanning to ensure the NAS management interface is not internet-accessible. Confirm that administrator passwords were rotated after remediation, that no unexpected administrator accounts or remote-access settings exist, and that backups remain intact and recoverable. For environments tracking the listed libjettison-java packages, verify installed package versions meet or exceed the fixed versions listed in remediation guidance.

Typical attack path

1. Scan the internet or internal network for TerraMaster NAS web management interfaces.
2. Fingerprint the device or TerraMaster OS version to identify potentially vulnerable systems running 4.2.29 or earlier.
3. Send an unauthenticated request to /module/api.php?mobile/webNasIPS with the HTTP header User-Agent: TNAS.
4. Parse the API response for the PWD field containing the administrative password.
5. Authenticate to the NAS management interface using the disclosed administrator credential.
6. Enumerate users, shares, mounted volumes, backup repositories, and network-accessible data.
7. Exfiltrate files, alter configuration, create new accounts, or chain with additional vulnerabilities for command execution.
8. Deploy ransomware or destructive tooling, encrypt or delete stored files, and attempt to remove evidence.

How to detect it

Review NAS web access logs, reverse proxy logs, WAF logs, firewall logs, and EDR/NDR telemetry for unauthenticated requests to /module/api.php?mobile/webNasIPS, especially when the User-Agent is TNAS. Correlate those requests with subsequent successful administrator logins, configuration changes, new user creation, SSH enablement, unusual file access, large downloads, mass file modifications, or deletion of backups. Because the exploit can be a simple GET request and may not leave a payload on disk, network and HTTP logs are the primary evidence. Look for responses that included or were generated by the webNasIPS API endpoint, then identify the source IPs and all activity from those IPs before and after the request. For ransomware-related exploitation, hunt for ransom notes, abnormal file extensions, high-volume file rename/write events, disabled services, deleted snapshots, and unexpected processes launched by NAS management components. If logs are unavailable or rotated, treat any internet-exposed vulnerable appliance as potentially compromised and perform credential rotation and integrity checks.

• /module/api.php?mobile/webNasIPS
• module/api.php?mobile/webNasIPS
• mobile/webNasIPS
• User-Agent: TNAS
• "TNAS"
• "PWD"
• "PWD":
• PWD=
• GET /module/api.php?mobile/webNasIPS
• POST /module/api.php?mobile/webNasIPS
• GET /module/api.php?mobile/webNasIPS HTTP/1.1" 200
• POST /module/api.php?mobile/webNasIPS HTTP/1.1" 200
• webNasIPS
• ransom note
• README_FOR_DECRYPT
• DECRYPT_INSTRUCTIONS
• RECOVER_FILES

What your security team should do

• Immediately identify all TerraMaster NAS appliances and prioritize any internet-exposed systems running 4.2.29 or earlier.
• Patch vulnerable TerraMaster NAS devices, then rotate administrator and user passwords because the vulnerability exposes credentials rather than merely allowing a transient action.
• Assume exposed vulnerable devices may be compromised; perform log review and forensic triage before returning them to trusted service.
• Remove direct internet access to NAS management interfaces and require VPN or tightly scoped firewall allowlists.
• Review NAS accounts, shares, scheduled tasks, remote access settings, SSH settings, startup scripts, and installed applications for unauthorized changes.
• Hunt for requests to /module/api.php?mobile/webNasIPS with User-Agent: TNAS, followed by successful administrative logins from the same source IP.
• Search for ransomware indicators such as mass file renames, ransom notes, unusual encryption activity, backup deletion, and sudden spikes in file-write operations.
• Validate offline or immutable backups for data stored on affected NAS appliances, since this vulnerability is associated with ransomware campaigns.
• If using distribution package advisories that map this issue to libjettison-java, deploy the listed Debian and Ubuntu fixed package versions through normal patch management.