High severity · published Aug 4, 2021
CVE-2021-32706
(Authenticated) Remote Code Execution Possible in Web Interface 5.5
8.8
CVSS
60.2%
EPSS
No
On KEV
Description
Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)60.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
AdminLTE · pi-hole
< 5.5.1 · source: vendor
PI
Pi-hole · Pi-hole
before 5.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32706
Release Notes
https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1
Exploit
https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259
More from AdminLTE
7.2
CVE-2020-8816
Pi-Hole AdminLTE Remote Code Execution Vulnerability
8.8
CVE-2023-23614
Improper session handling of "Remember me for 7 days" functionality
5.4
CVE-2021-41175
Stored XSS in Client Groups Management (Authenticated)
5.3
CVE-2022-23513
Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
4.8
CVE-2022-31029
Authenticated XSS in Pi-hole AdminLTE