Pi-hole Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in Pi-hole versions 6.0 through 6.4.2. The issue allows a user with code execution as the unprivileged 'pihole' user to escalate privileges to root. This is achieved by replacing the logrotate configuration file in an attacker-writable directory. The replacement file is then owned by root after being processed by a startup script, and subsequently executed as root by a scheduled cron job, leading to unauthorized actions being performed with elevated privileges.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation from the 'pihole' user to root, enabling full administrative access on the system.

Reproduction

To reproduce this vulnerability, first replace the root-owned logrotate configuration file with a new one that includes a 'firstaction' directive to execute commands as root. After the file is replaced, the 'pihole-FTL' process can be killed, which triggers the systemd auto-restart and launder the file ownership to root. Once the logrotate configuration is owned by root, the 'firstaction' commands will be executed with root privileges, completing the privilege escalation.

Remediation

Users can update to Pi-hole version 6.4.3 or later, where this vulnerability has been patched.