CVE-2024-34361

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.5 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

2.83% chance of exploitation in the next 30 days, 86th percentile

Published

2024-07-05

Updated

2024-08-02

Proof-of-concept exploits (3)

• pi-hole/pi-hole/security/advisories/GHSA-jg6g-rrj6-xfg6
• T0X1Cx/CVE-2024-34361-PiHole-SSRF-to-RCE1★ · 2026-01-30
• T0X1Cx/CVE-2024-34361-Pi-Hole-SSRF-to-RCE

References

• CVE Record
• NVD entry

Related

• CVE-2021-32706
• CVE-2022-23513
• CVE-2023-23614
• CVE-2024-28247
• CVE-2021-36393
• CVE-2021-36396