CVE-2022-50919
📋 TL;DR
CVE-2022-50919 is an unauthenticated remote code execution vulnerability in Tdarr's Help terminal that allows attackers to inject arbitrary commands. Attackers can chain commands to execute malicious code without authentication, potentially compromising the entire system. All users running vulnerable Tdarr versions are affected.
💻 Affected Systems
- Tdarr
📦 What is this software?
Tdarr by Tdarr
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, exfiltrate data, pivot to other systems, or deploy ransomware across the network.
Likely Case
Attackers gain initial foothold on the system, install cryptocurrency miners or backdoors, and potentially access sensitive media processing data.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting the Tdarr application container.
🎯 Exploit Status
Public exploit available on Exploit-DB (50822) with simple command injection payloads. Attack requires no authentication and minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.00.16 and later
Vendor Advisory: https://tdarr.io
Restart Required: Yes
Instructions:
1. Stop Tdarr service. 2. Update to version 2.00.16 or later via package manager or manual download. 3. Restart Tdarr service. 4. Verify version is updated.
🔧 Temporary Workarounds
Disable Help Terminal
allDisable the vulnerable Help terminal feature if immediate patching isn't possible
Modify Tdarr configuration to disable Help terminal or restrict access
Network Access Control
linuxRestrict network access to Tdarr instance using firewall rules
iptables -A INPUT -p tcp --dport [Tdarr_port] -s [trusted_ips] -j ACCEPT
iptables -A INPUT -p tcp --dport [Tdarr_port] -j DROP
🧯 If You Can't Patch
- Isolate Tdarr instance on separate VLAN with strict network segmentation
- Implement application-level firewall or WAF with command injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check Tdarr version via web interface or configuration file. Versions 2.00.15 and earlier are vulnerable.Check Version:
Check Tdarr web interface dashboard or configuration files for version informationVerify Fix Applied:
Verify version is 2.00.16 or later. Test Help terminal with command injection attempts (e.g., '--help; echo test') should fail.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in Tdarr logs
- Multiple failed command injection attempts
- Suspicious Help terminal usage patterns
Network Indicators:
- Outbound connections from Tdarr to unusual destinations
- Command and control traffic patterns
- Unexpected file downloads
SIEM Query:
source="tdarr.log" AND ("--help;" OR "|" OR ";" OR "&&" OR command injection patterns)