PT-2021-18223 · Pi-Hole · Pi-Hole

Emanuele Barbeno · Published 2021-04-14 · Updated 2022-08-02 · CVE-2021-29449

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Pi-hole core version 5.2.4

Description: Multiple privilege escalation issues were discovered in Pi-hole core. Pi-hole is a Linux network-level advertisement and Internet tracker blocking application.

Recommendations: For version 5.2.4, update to a newer version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

OS Command Injection

Weakness Enumeration

CWE-269

CWE-78

Related Identifiers

CVE-2021-29449

GHSA-3597-244C-WRPJ

Affected Products

Pi-Hole

References · 8

• 🔥 https://github.com/pi-hole/pi-hole/security/advisories/GHSA-3597-244c-wrpj · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/pihole_remove_commands_lpe.rb · Exploit
• 🔥 https://compass-security.com/fileadmin/Research/Advisories/2021-02_CSNC-2021-008_Pi-hole_Privilege_Escalation.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/163715/Pi-Hole-Remove-Commands-Linux-Privilege-Escalation.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-29449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29449 · Security Note
• https://t.me/cvenotify/13233 · Telegram Post
• https://t.me/cvenotify/13792 · Telegram Post