hitarth-gg Zenshin OS Command Injection Vulnerability

A command injection vulnerability has been identified in the Zenshin application by hitarth-gg, specifically in versions prior to 2.7.0. The issue arises within the '/stream-to-vlc' route, where user-supplied input in the 'url' parameter is not properly validated before being passed to a command execution function. This flaw allows remote attackers to execute arbitrary commands on the server where the application is running.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system.

Reproduction

To reproduce this vulnerability, send a request to the '/stream-to-vlc' endpoint with a crafted 'url' parameter that includes shell metacharacters. The application will execute the injected command on the server.

Remediation

Users can update to Zenshin version 2.7.1 or later, where this vulnerability has been fixed.