PT-2021-19872 · Pi-Hole · Pi-Hole

Chris Schneider + 1 · Published 2021-08-04 · Updated 2022-04-25 · CVE-2021-32706

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 5.5.1

Description The issue lies in the validDomainWildcard preg match filter, which allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. This is due to one of the periods not being escaped, allowing any character to be used in its place.

Recommendations For versions prior to 5.5.1, update to version 5.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the validDomainWildcard preg match filter until the patch is applied.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-32706

GHSA-5CM9-6P3M-V259

Affected Products

Pi-Hole

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/pihole_domains_api_exec.rb · Exploit
• 🔥 https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259 · Exploit
• https://osv.dev/vulnerability/CVE-2021-32706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32706 · Security Note
• https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1 · Note
• https://t.me/cvenotify/18661 · Telegram Post
• https://t.me/cibsecurity/26847 · Telegram Post
• https://t.me/cvenotify/19216 · Telegram Post