Pi-hole Remote Code Execution
natedotred.wordpress.com
Pi-hole Remote Code Execution
1–10 of 46 posts
Re: Pi-hole Remote Code Execution
#21) You have be be logged into the pi-hole
2) Requires the user to post into a MAC Address field
While I agree this should be fixed. This is a pretty low issue
Re: Pi-hole Remote Code Execution
#3The root of this issue seems to be a regexp function (preg_match()) in PHP coupled with an exec() of a variable that was not properly screened, coupled with an 'sudo' inside of the exec(), e.g.:
exec("sudo pihole -a addstaticdhcp ".$mac." ".$ip." ".$hostname);
and/or
exec("sudo pihole -a removestaticdhcp ".$mac);
So three places to audit:
1) Regexp's and related complex high-level functions;
2) Calls to exec()
3) Uses of sudo within an exec()
Re: Pi-hole Remote Code Execution
#4> exec("sudo ... " . $user_input_string ...)
Wow, this is always a mistake and a huge one. exec() is dangerous, exec calling with sudo more so, and should never be used in conjunction with unprivileged user input like this. Granted a weak attempt was made to sanitize the user string, but so weak one might wonder if it is Underhanded Code at play here.
The big problem with this sort of issue is that it indicates that there almost certainly are massive security problems elsewhere in this code base since this one is low hanging fruit that never should have made it past even rudimentary code review by anyone with a bare minimum knowledge of security.
Re: Pi-hole Remote Code Execution
#5Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?
Re: Pi-hole Remote Code Execution
#61) You have be be logged into the pi-hole 2) Requires the user to post into a MAC Address field While I agree this should be fixed. This is a pretty low issue
AFAIK Pi-holes are almost always going to be sitting inside a LAN and owned by whoever owns the other devices on the network too, so the risk is quite low.
Re: Pi-hole Remote Code Execution
#7The dev trusted a regexp to 'validate' user input for a _privileged_ command execution, a function which fails at validating a constant-sized, colon-separated sequence of hex numbers in a string, everything about the input screams structure, and yet it was still half-assed!
Although this requires you to authenticate at the web portal, so 'some' sort of trust is necessary to gain this level of access. I believe they even have some plan of letting authenticated users update the pi-hole code from the web interface by the wording on this issue: https://discourse.pi-hole.net/t/how-do-i-update-pi-hole/249.
A funny thought: you can create a script (that uses the default password) to inject a code to schedule an update to the pi-hole (and revert the changed permissions) which fixes the vulnerability and leaves no trace! These possibilities reminds me of a hacker series!
Re: Pi-hole Remote Code Execution
#8Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?
Requires a POST that would hit CORS pretty hard
Re: Pi-hole Remote Code Execution
#9> exec("sudo ... " . $user_input_string ...) Wow, this is always a mistake and a huge one. exec() is dangerous, exec calling with sudo more so, and should never be used in conjunction with unprivileged user input like this. Granted a weak attempt was made to sanitize the user string, but so weak one might wonder if it is Underhanded Code at play here. The big problem with this sort of issue is that it indicates that…
Code review on a open source project....
Mind you they trusted a regex that looks pretty sane (A preg_replace might of been better)
Re: Pi-hole Remote Code Execution
#10The dev trusted a regexp to 'validate' user input for a _privileged_ command execution, a function which fails at validating a constant-sized, colon-separated sequence of hex numbers in a string, everything about the input screams structure, and yet it was still half-assed! Although this requires you to authenticate at the web portal, so 'some' sort of trust is necessary to gain this level of access. I believe they e…
Hmm, wonder if this is the type of stuff a static code analysis would pick up like (veracode)