Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pi-hole Remote Code Execution

natedotred.wordpress.com

Post reply on HN
Print view View original

21–30 of 46 posts

Re: Pi-hole Remote Code Execution

#21

Post by deathanatos »

jrwr wrote: post #8
0x0 wrote: post #5

Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?

Requires a POST that would hit CORS pretty hard

Not all POST requests require a CORS preflight. In particular, "normal" form submissions, like the type that are accessed via $_POST in the article, do not.

Specifically, "simple requests" do not, covered here[1]. This case is POST, with a Content-Type of application/x-www-form-urlencoded. (The rule of thumb you can use is that these were all essentially possible to send prior to CORS even existing. To send a POST, you would construct a form tag with the inputs filled in with the desired values, set the target URL to the "victim" site, and have JS submit the form.)

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simpl...

Re: Pi-hole Remote Code Execution

#23

Post by bubblethink »

userbinator wrote: post #6
jrwr wrote: post #2

1) You have be be logged into the pi-hole 2) Requires the user to post into a MAC Address field While I agree this should be fixed. This is a pretty low issue

AFAIK Pi-holes are almost always going to be sitting inside a LAN and owned by whoever owns the other devices on the network too, so the risk is quite low.

In general, yes, but this is how real issues start. Look at all the bmc software written in the world. It's utter horseshit. You are supposed to use a dedicated vlan for accessing the bmc. Everyone is still fighting the bmc software and it is routinely accessed over the open internet.

Re: Pi-hole Remote Code Execution

#24

Post by neuralzen »

droithomme wrote: post #4

> exec("sudo ... " . $user_input_string ...) Wow, this is always a mistake and a huge one. exec() is dangerous, exec calling with sudo more so, and should never be used in conjunction with unprivileged user input like this. Granted a weak attempt was made to sanitize the user string, but so weak one might wonder if it is Underhanded Code at play here. The big problem with this sort of issue is that it indicates that…

Using sudo in the exec() isn't really a problem, since any RCE an attacker would get will have the same privileges as the pihole service...they could just use sudo in their RCE if the user is in sudousers (assuming they could even use sudo on their bash session when establishing the reverse shell). In the case of the PoC here, sudo doesn't even come into play, they are stacking commands with && which would require another sudo call to elevate (which they don't do in the example).

Re: Pi-hole Remote Code Execution

#25

Post by droithomme »

corndoge wrote: post #17
droithomme wrote: post #4

> exec("sudo ... " . $user_input_string ...) Wow, this is always a mistake and a huge one. exec() is dangerous, exec calling with sudo more so, and should never be used in conjunction with unprivileged user input like this. Granted a weak attempt was made to sanitize the user string, but so weak one might wonder if it is Underhanded Code at play here. The big problem with this sort of issue is that it indicates that…

So find the rest and fix them

I'd be happy to help you with this. My rate is $235/hr, minimum 30 hours. When can I expect your deposit so we can get started?

Re: Pi-hole Remote Code Execution

#26

Post by itsnotlupus »

0x0 wrote: post #5

Does this pihole admin interface perform any kind of CSRF protection, or can this be exploites by any random website as long as the victim has a browser tab with a valid session?

There's a csrf token set in a php session that's hard to guess that needs to be provided in form data, yes.

Probably difficult to exploit that way without first finding another bug to retrieve that token from a random origin.

Re: Pi-hole Remote Code Execution

#27

Post by quickthrowman »

needle0 wrote: post #22

Why the sudden use of the "Black Jack ni Yoroshiku" manga comic art? I know the author released the entire thing with permissions to freely use the art anywhere, but still.

A family member of mine was the original author of pi-hope. He sold the company to his partner last year, so any changes in aesthetics would be due to the change in ownership.

Re: Pi-hole Remote Code Execution

#30

Post by bitten »

userbinator wrote: post #6
jrwr wrote: post #2

1) You have be be logged into the pi-hole 2) Requires the user to post into a MAC Address field While I agree this should be fixed. This is a pretty low issue

AFAIK Pi-holes are almost always going to be sitting inside a LAN and owned by whoever owns the other devices on the network too, so the risk is quite low.

Yes definitely. My ISP does not allow me to expose a DNS server to the internet, they told me it was against the law. So it seems you'd have to break the law in my country in order to be vulnerable to this!
Post reply on HN