31–40 of 46 posts
Why is it that, instead of just forking and making a patch is nowadays replaced with a CVE focus. Are CVE's the new big thing on your CV?
You have to be an authenticated user on the admin portal. Doesn't this already come with the expectation of being able to fully control the device?
The root of this issue seems to be a regexp function (preg_match()) in PHP coupled with an exec() of a variable that was not properly screened, coupled with an 'sudo' inside of the exec(), e.g.: exec(" sudo pihole -a addstaticdhcp ".$mac." ".$ip." ".$hostname); and/or exec(" sudo pihole -a removestaticdhcp ".$mac); So three places to audit: 1) Regexp's and related complex high-level functions; 2) Calls to exec() 3) U…
The problem is that php expects a string that is then passed to sh -c, which is then parsed by a shell. Instead php should have an interface that accepts: exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]); without any shell trickery. If there's a sudo in this specific like doesn't matter, your reverse shell is going to run as a regular user and after that it only matters low locked down the sudoer…
You can even implement a "safe" exec function like so:
function safe_exec(array $args, array &$output = null, int &$return_var = 0) : string {
return exec(
implode(' ',
array_map('escapeshellarg', $args)
), $output, $return_var
);
}
// Example usage
$output = [];
$return_var = 0;
echo safe_exec(['ls', '/tmp'], $output, $return_var);
var_export($output);
echo "Exit code: $return_var\n";
Earlier quoted context omitted.
AFAIK Pi-holes are almost always going to be sitting inside a LAN and owned by whoever owns the other devices on the network too, so the risk is quite low.
Yes definitely. My ISP does not allow me to expose a DNS server to the internet, they told me it was against the law. So it seems you'd have to break the law in my country in order to be vulnerable to this!
1) You have be be logged into the pi-hole 2) Requires the user to post into a MAC Address field While I agree this should be fixed. This is a pretty low issue
You have to be an authenticated user on the admin portal. Doesn't this already come with the expectation of being able to fully control the device?
Not necessarily, web GUI password and user/root ones can be different. From an attacker's point of view: he just needs to crack the Wi-fi (e.g. aircrack-ng), join the LAN an then bruteforce the Pi-Hole webadmin password.
Earlier quoted context omitted.
AFAIK Pi-holes are almost always going to be sitting inside a LAN and owned by whoever owns the other devices on the network too, so the risk is quite low.
In general, yes, but this is how real issues start. Look at all the bmc software written in the world. It's utter horseshit. You are supposed to use a dedicated vlan for accessing the bmc. Everyone is still fighting the bmc software and it is routinely accessed over the open internet.
Earlier quoted context omitted.
So find the rest and fix them
I'd be happy to help you with this. My rate is $235/hr, minimum 30 hours. When can I expect your deposit so we can get started?