CVE-2024-34361 - CVE House

Back to Database

Status published High CVE-2024-34361

Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)

8.6 CVSS

Vulnerability Description

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-34361

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pi-hole

View All →

Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection

Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page

Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)

Pihole Authenticated Arbitrary File Read with root privileges

Improper session handling of "Remember me for 7 days" functionality

Affected Vendor

pi-hole

View all reports →

Affected Software

pi-hole

Vulnerable Versions:

< 5.18.3

Timeline

Official Publish: July 5th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery