CVE-2024-34361

Published: Jul 5, 2024Modified: Oct 2, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

Affected (1)

Products: Pi Hole: Pi Hole

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pi Hole Pi Hole	Before 5.18.3

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/pi-hole/pi-hole/commit/2c497a9a3ea099079bbcd1eb21725b0ed54b529d

Source: security-advisories@github.com

Patch

https://github.com/pi-hole/pi-hole/security/advisories/GHSA-jg6g-rrj6-xfg6

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/pi-hole/pi-hole/commit/2c497a9a3ea099079bbcd1eb21725b0ed54b529d

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/pi-hole/pi-hole/security/advisories/GHSA-jg6g-rrj6-xfg6

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

Timeline

No history available yet.