Improper session handling of "Remember me for 7 days" functionality

CVE-2023-23614

What is CVE-2023-23614?

The Pi-hole web interface, derived from AdminLTE, is susceptible to an Insufficient Session Expiration vulnerability. This issue arises from the improper utilization of the admin WEBPASSWORD hash, which is stored as a cookie value under the 'Remember me for 7 days' feature. Attackers can exploit this vulnerability to perform a hash pass, granting unauthorized access without cracking the actual password. Although the cookie is designed to expire after 7 days, as long as the admin password remains unchanged, the associated hash remains valid. This security flaw allows attackers with access to the password hash through other means, such as path traversal vulnerabilities, to gain admin login access easily. The hash is transmitted over the network and stored in the browser, further increasing the risk of exploitation. This vulnerability was addressed in version 5.18.3.

References