Tdarr Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability allowing unauthenticated remote code execution has been identified in Tdarr version 2.00.15. The issue arises in the Help terminal, where the lack of input filtering enables attackers to inject and chain arbitrary commands. Exploitation can be achieved by, for example, appending command injection payloads to the '--help' option, such as using 'curl' to download a Python script and execute it, thereby executing remote code without authentication.

Impact

Exploitation of this vulnerability allows for unauthenticated remote code execution on the server where Tdarr is running.

Reproduction

To reproduce this vulnerability, access the Help terminal in Tdarr 2.00.15. The terminal does not filter input, allowing commands to be chained. For example, entering '--help; whoami' will execute the 'whoami' command and return the result. Similarly, commands can be injected to download and execute files, such as a Python script.