Pi-Hole 2.8.1 Cross Site Scripting
Posted on 17 August 2016
# Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file # Author: loneferret from Kioptrix # Product: Pi-Hole # Version: Web Interface 1.3 # Web Interface software: https://github.com/pi-hole/AdminLTE # Version: Pi-Hole v2.8.1 # Discovery date: July 20th 2016 # Vendor Site: https://pi-hole.net # Software Download: https://github.com/pi-hole/pi-hole # Tested on: Ubuntu 14.04 # Solution: Update to next version. # Software description: # The Pi-hole is an advertising-aware DNS/Web server. If an ad domain is queried, # a small Web page or GIF is delivered in place of the advertisement. # You can also replace ads with any image you want since it is just a simple # Webpage taking place of the ads. # Note: Not much of a vulnerability, implies you already have access # to the box to begin with. Still best to use good coding practices, # and avoid such things. # Vulnerability PoC: Stored XSS # Insert this: # <script>alert('This happens...');</script> # In either /etc/pihole/blacklist.txt || /etc/pihole/whitelist.txt # # Then navigate to: # http://pi-hole-server/admin/list.php?l=white # or # http://pi-hole-server/admin/list.php?l=black # # And a pop-up will appear. # Disclosure timeline: # July 20th 2016: Sent initial email to author. # July 21st 2016: Response, bug has been forwarded to web dev people # July 22nd 2016: Asked to be kept up to date on fix # July 27th 2016: Author replied saying he shall # July 28th 2016: - Today I had chocolat milk - # August 3rd 2016: Reply saying there's a fix, waiting on "Mark" to confirm # August 3rd 2106: Supplies URL to fix from Github https://github.com/pi-hole/AdminLTE/pull/120 # August 4th 2016: Thanked him for fix, informed him of a lame LFI in the web interface as well. # August 4th 2016: - While drinking my coffee, I realize my comments are longer than the actual PoC. - # August 10th 2016: Still nothing # August 12th 2016: Submitting this is taking too much time to integrate their fix -- Notice: This email does not mean I'm consenting to receiving promotional emails/spam/etc. Remember Canada has laws.
