3 ms·

Pi-hole 4.4.0 Remote Code Execution

• slenk 6y ago
  FWIW 5.0 has been out for a bit and addresses this vuln. Also, here is actual info about the vuln: https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/ https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi...
  • shadycuz 6y ago
    This is a different vuln CVE-2020-11108
    • slenk 6y ago
      Hmmm, at least its still for an outdated version
  • pstrateman 6y ago
    When 5.0 was released the comments were full of people saying they had forgotten about the pi hole they were using. I bet most installs are running very old software.
    • lilSebastian 6y ago
      That tends to happen with 'it just works' solutions, until it either doesn't or causes some other problem
• smithza 6y ago
  How would privilege escalation work in this case?
  • drjasonharrison 6y ago
    Regarding the older CVE-2020-8816: The code sent in the request is executed using sudo. From there, the code can use curl/wget to download a script from a specified server, and execute the script as root and take over the device. For this CVE, here is a description: https://frichetten.com/blog/cve-2020-11108-pihole-rce/ https://frichetten.com/blog/cve-2020-11108-pihole-rce/
• coolspot 6y ago
  Vulnerability requires web access and password for the pi-hole.
  • pocw 6y ago
    ^Thanks for that. I was frantically looking to patch my pihole till I saw this comment. Everyone else, action item: Make sure your pihole web interface is not public (duh) and that you set a non-trivial password (sorta duh)