External Control of File Name or Path in Pi-hole - CVE-2024-28247
Published: March 28, 2024 / Updated: April 5, 2024
Vulnerability identifier: #VU87908
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N]
CVE-ID: CVE-2024-28247
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to read arbitrary files on the system.
The vulnerability exists due to application allows an attacker to control path of the files to read when accessing them via the "file://" handler. A remote attacker can send a specially crafted request and read arbitrary files on the system with root privileges.
Affected software
Pi-hole
How to mitigate CVE-2024-28247
Install updates from vendor's website.
Pi-hole - update to 5.18