Pi-Hole Remove Commands Linux Privilege Escalation
Posted by deepcore on July 31, 2021 – 6:16 am
Pi-Hole versions 3.0 through 5.3 allows for command line input to the removecustomcname, removecustomdns, and removestaticdhcp functions without properly validating the parameters before passing to sed. When executed as the www-data user, this allows for a privilege escalation to root since www-data is in the sudoers.d/pihole file with no password.
Post a reply
You must be logged in to post a comment.