Pi-hole SSRF to RCE Vulnerability via CVE-2024-34361

CVE-2024-34361 is a security vulnerability in the Pi-hole DNS sinkhole software affecting versions 5.18.2 and earlier. The flaw stems from improper validation of URL inputs, specifically within the authenticated admin login endpoint. An attacker who has gained low-level authenticated access to the Pi-hole administration interface can leverage this input validation weakness to trigger a Server-Side Request Forgery (SSRF). By manipulating the request body, an attacker can coerce the application to send requests to arbitrary internal services.

Technical analysis indicates that this SSRF can be escalated to full Remote Code Execution (RCE) through the use of the Gopherus protocol, which allows the crafting of payloads for various services. Successful exploitation grants the attacker the ability to execute arbitrary commands on the underlying host, leading to a complete compromise of system integrity and availability. The availability of public exploit proof-of-concept (PoC) code significantly increases the risk of exploitation for organizations currently running unpatched instances of Pi-hole.

Attack Chain

1. Attacker obtains low-level credentials to access the Pi-hole web-based administration interface.
2. Attacker navigates to the 'admin/login.php' endpoint and establishes an authenticated session.
3. Attacker identifies a vulnerable input parameter in the request body that fails to properly sanitize URLs.
4. Attacker crafts a malicious request payload incorporating the Gopherus protocol syntax to target internal services or local binaries.
5. The Pi-hole server processes the malicious URL, triggering an outbound SSRF request to the specified target.
6. The SSRF payload exploits the target service or local system component to execute system-level commands.
7. Attacker achieves remote code execution, granting persistent access or the ability to perform further post-exploitation actions on the host.

Impact

Successful exploitation of CVE-2024-34361 results in full remote code execution on the server hosting the Pi-hole instance. This allows attackers to exfiltrate sensitive network configurations, pivot to other internal network segments, or disrupt DNS resolution services provided by the sinkhole. Given the common deployment of Pi-hole as a central network-wide DNS filtering mechanism, compromise of this host represents a significant threat to internal visibility and security controls.

Recommendation

1. Immediately upgrade all instances of Pi-hole to version 5.18.3 or later to mitigate CVE-2024-34361.
2. Restrict access to the Pi-hole administration interface to trusted management networks only, preventing unauthorized authentication that acts as a prerequisite for this exploit.
3. Deploy web application firewall (WAF) rules to inspect and filter suspicious traffic containing protocol handlers like 'gopher://' or anomalous URI query parameters targeting 'admin/login.php'.
4. Implement network segmentation to isolate DNS infrastructure from critical internal service segments to limit the blast radius of a potential SSRF-based pivot.