(Authenticated) Remote Code Execution Possible in Web Interface 5.5
CVE-2021-32706

7.6HIGH

Key Information:

Vendor

Pi-hole

Status
Adminlte
Vendor
CVE Published:
4 August 2021

What is CVE-2021-32706?

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the validDomainWildcard preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.

Affected Version(s)

AdminLTE < 5.5.1

References

https://github.com/pi-hole/AdminLTE/security/advisories/G...
x_refsource_CONFIRM
https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1
x_refsource_MISC

EPSS Score

59% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.