PT-2024-27167 · Unknown+1 · Adguardhome+1

Itz-D0Dgy + 1 · Published 2024-10-08 · Updated 2024-11-05 · CVE-2024-36814

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Adguard Home versions prior to 0.107.52

Description An arbitrary file read issue allows authenticated attackers to access arbitrary files as root on the underlying Operating System by placing a crafted file into a readable directory. This poses a serious security risk, enabling attackers to read sensitive files on systems running Adguard Home.

Recommendations For versions prior to 0.107.52, update to version 0.107.52 or later to resolve the issue. As a temporary workaround, consider restricting access to readable directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-36814

GHSA-9CP9-8GW2-8V7M

GO-2024-3184

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Adguardhome

Suse

References · 82

• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36814 · Security Note
• https://osv.dev/vulnerability/GO-2024-3184 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9cp9-8gw2-8v7m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36814 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/AdguardTeam/AdGuardHome · Note
• https://github.com/AdguardTeam/AdGuardHome/blob/7c002e1a99b9b4e4a40e8c66851eda33e666d52d/internal/filtering/http.go#L23C1-L51C2 · Note
• https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.53 · Note
• https://github.com/AdguardTeam/AdGuardHome/commit/e8fd4b187287a562cbe9018999e5ea576b4c7d68 · Note
• https://suse.com/security/cve/CVE-2024-47825 · Note
• https://suse.com/security/cve/CVE-2024-49380 · Note
• https://twitter.com/Brandefense/status/1845864145733775665 · Twitter Post
• https://suse.com/security/cve/CVE-2024-8185 · Note