PT-2020-12554 · Pi-Hole · Pi-Hole

Published 2020-05-11 · Updated 2020-05-27 · CVE-2020-11108

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pi-hole versions 4.4 and earlier

Description The issue allows an authenticated adversary to upload arbitrary files, which can be abused for Remote Code Execution by writing to a PHP file in the web directory. This can also be used in conjunction with the sudo rule for the www-data user to escalate privileges to root. The code error is in the gravity DownloadBlocklistFromUrl function in gravity.sh.

Recommendations For Pi-hole versions 4.4 and earlier, update to version 5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the gravity.sh script and the web directory to minimize the risk of exploitation. Avoid using the gravity DownloadBlocklistFromUrl function in gravity.sh until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-11108

Affected Products

Pi-Hole

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/pihole_blocklist_exec.rb · Exploit
• 🔥 https://github.com/frichetten/CVE-2020-11108-PoC · Exploit
• 🔥 https://github.com/Frichetten/CVE-2020-11108-PoC · Exploit
• 🔥 https://exploit-db.com/exploits/48443 · Exploit
• 🔥 https://exploit-db.com/exploits/48491 · Exploit
• 🔥 https://exploit-db.com/exploits/48519 · Exploit
• 🔥 http://packetstormsecurity.com/files/157623/Pi-hole-4.4-Remote-Code-Execution.html · Exploit
• 🔥 https://frichetten.com/blog/cve-2020-11108-pihole-rce · Exploit
• 🔥 http://packetstormsecurity.com/files/157624/Pi-hole-4.4-Remote-Code-Execution-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/48442 · Exploit
• https://osv.dev/vulnerability/CVE-2020-11108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11108 · Security Note
• https://t.me/defcon_news/46718 · Telegram Post
• http://packetstormsecurity.com/files/157839/Pi-hole-4.4.0-Remote-Code-Execution.html · Note
• https://t.me/club1337/49 · Telegram Post