PT-2022-21138 · Adguard+1 · Adguardhome+1

Published 2022-10-11 · Updated 2024-11-22 · CVE-2022-32175

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions AdGuardHome versions v0.95 through v0.108.0-b.13

Description The issue affects the custom filtering rules functionality, where an attacker can exploit it to delete or modify these rules by persuading an authorized user to follow a malicious link. This is a result of a Cross-Site Request Forgery (CSRF) vulnerability.

Recommendations For versions v0.95 through v0.108.0-b.13, update to a version newer than v0.108.0-b.13, specifically v0.108.0-b.16 or later, where the file containing the vulnerable code is no longer present. As a temporary workaround, consider restricting access to the custom filtering rules functionality until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2024-15846

CVE-2022-32175

GHSA-MWWC-3JV2-62J3

Affected Products

Alt Linux

Adguardhome

References · 10

• 🔥 https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.13/internal/home/controlfiltering.go#L265 · Exploit
• 🔥 https://mend.io/vulnerability-database/CVE-2022-32175 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-32175 · Security Note
• https://osv.dev/vulnerability/GHSA-mwwc-3jv2-62j3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32175 · Vendor Advisory
• https://github.com/AdguardTeam/AdGuardHome · Note
• https://github.com/AdguardTeam/AdGuardHome/commit/756b14a61de138889130c239406dae43f1f115cb · Note
• https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.15/internal/home/controlfiltering.go · Note
• https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.16/internal/home/controlfiltering.go · Note
• https://t.me/cibsecurity/51120 · Telegram Post