Executive Summary

This vulnerability exists in Pi-hole versions from 6.0 to before Core 6.4.2 and FTL 6.6.1. Two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read a file path from the configuration without validating it. An attacker with pihole privilege can write an arbitrary path into this configuration, causing the scripts to delete and recreate any file on the system outside certain restricted directories with root privileges.

On a default Pi-hole installation, this allows local privilege escalation to root by manipulating SSH authorized keys. If the root SSH authorized_keys file does not exist, only one script execution is needed; if it exists, both scripts run in sequence during a restart to achieve the exploit.

This vulnerability was fixed in Core 6.4.2 and FTL 6.6.1.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Pi-hole Core versions from 6.0 to before 6.4.2 and FTL versions before 6.6.1, where two shell scripts executed as root by systemd read an unvalidated files.pid path from the configuration and perform privileged file operations. Detection involves verifying the installed versions of Pi-hole Core and FTL to see if they fall within the vulnerable range.

To detect if your system is vulnerable, you can check the installed versions of Pi-hole Core and FTL using the following commands:

• pihole -v

This command outputs the versions of Core and FTL. If Core is between 6.0 and before 6.4.2, or FTL is before 6.6.1, the system is vulnerable.

Additionally, you can inspect the systemd service files or the scripts pihole-FTL-prestart.sh and pihole-FTL-poststop.sh to check if they are present and executed as root, which is part of the vulnerability mechanism.

Since the vulnerability involves manipulation of the files.pid path, you may also check for suspicious entries or modifications in the Pi-hole configuration files related to files.pid.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to local privilege escalation, allowing an attacker with limited Pi-hole privileges to gain root access on the affected system.

With root access, the attacker can manipulate critical system files, including SSH authorized keys, potentially allowing persistent unauthorized access and full control over the system.

This can compromise the security and integrity of the system, leading to data breaches, system manipulation, or further attacks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Pi-hole Core to version 6.4.2 or later and Pi-hole FTL to version 6.6.1 or later, as these versions contain the fix.

Until the upgrade is applied, restrict access to the pihole user privileges to prevent attackers from writing arbitrary paths into files.pid.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a local attacker with pihole privileges to escalate to root by manipulating file operations, potentially leading to unauthorized access and modification of sensitive system files.

Such unauthorized root access and file manipulation could lead to breaches of confidentiality, integrity, and availability of data, which are critical aspects of compliance with standards like GDPR and HIPAA.

However, the provided information does not explicitly describe the impact on compliance with these regulations.

Useful 0 Not Useful 0