PT-2024-22362 · Pi-Hole · Pi-Hole
T0X1Cx
·
Published
2024-03-27
·
Updated
2025-10-10
·
CVE-2024-28247
CVSS v3.1
7.6
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Pihole versions prior to 5.18
Description
A vulnerability has been discovered in Pihole that allows an authenticated user on the platform to read internal server files arbitrarily, and because the application runs from behind, reading files is done as a privileged user. The problem resides in the update through local files. When updating from a file which contains non-domain lines, 5 of the non-domain lines are printed on the screen, so if you provide it with any file on the server which contains non-domain lines it will print them on the screen.
Recommendations
For Pihole versions prior to 5.18, update to version 5.18 to fix the vulnerability. As a temporary workaround, consider restricting access to the update functionality through local files to minimize the risk of exploitation. Avoid using the
Adslists feature with URLs starting with "file*" until the issue is resolved.Exploit
Fix
Improper Privilege Management
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pi-Hole