Description
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Pi-Hole DHCP MAC OS Command Execution
exploit/unix/http/pihole_dhcp_mac_exec
Exploit-DB 1
- Pi-hole 4.3.2 - Remote Code Execution (Authenticated) EDB-48727 · webapps · Aug 4, 2020
GitHub 4 repositories
-
cybervaca/CVE-2020-8816 ★ 11 · Aug 4, 2020
Pi-hole Remote Code Execution authenticated Version >= 4.3.2
-
AndreyRainchik/CVE-2020-8816 ★ 10 · May 10, 2020
A Python script to exploit CVE-2020-8816, a remote code execution vulnerability on the Pi-hole
-
team0se7en/CVE-2020-8816 ★ 6 · Aug 6, 2020
Pi-hole ( <= 4.3.2) authenticated remote code execution.
-
martinsohn/CVE-2020-8816 ★ 1 · Jun 15, 2020
A PoC for CVE-2020-8816 that does not use $PATH but $PWD and globbing
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://github.com/pi-hole/AdminLTE/commits/master
- http://packetstormsecurity.com/files/157861/Pi-Hole-4.3.2-DHCP-MAC-OS-Command-Execution.html
- https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/
- https://twitter.com/Nate_Kappa/status/1243900213665902592?s=20
- https://github.com/pi-hole/AdminLTE/releases/tag/v4.3.3
- https://github.com/pi-hole/AdminLTE/pull/1165
- http://packetstormsecurity.com/files/158737/Pi-hole-4.3.2-Remote-Code-Execution.html