CVE-2024-34361: pi-hole Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2024-34361 is a high (CVSS 8.8) Server-Side Request Forgery (SSRF) vulnerability in pi-hole. EPSS estimates a 2.83% chance of exploitation in the next 30 days, higher than 86.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-07-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.