CVE-2021-41175
📋 TL;DR
CVE-2021-41175 is a cross-site scripting (XSS) vulnerability in Pi-hole's web interface that allows attackers to inject malicious scripts when adding clients via the groups-clients management page. This affects Pi-hole administrators who use versions before 5.8. Successful exploitation could lead to session hijacking, credential theft, or unauthorized actions.
💻 Affected Systems
- Pi-hole AdminLTE Web Interface
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains administrative access to Pi-hole, modifies DNS settings to redirect traffic, steals credentials, or installs malware on administrator devices.
Likely Case
Session hijacking leading to unauthorized configuration changes, credential theft from administrators, or defacement of the web interface.
If Mitigated
Limited impact due to network segmentation, proper access controls, and regular patching practices.
🎯 Exploit Status
Exploitation requires an authenticated administrator to interact with malicious content, making it a reflected XSS attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8
Vendor Advisory: https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43
Restart Required: Yes
Instructions:
1. Update Pi-hole using 'pihole -up' command. 2. Verify update to version 5.8 or later. 3. Restart Pi-hole services if not done automatically.
🔧 Temporary Workarounds
Disable Web Interface Access
linuxTemporarily disable access to the Pi-hole web interface until patching can be completed.
sudo systemctl disable lighttpd
sudo systemctl stop lighttpd
Restrict Web Interface Access
linuxLimit web interface access to trusted IP addresses only using firewall rules.
sudo ufw allow from 192.168.1.0/24 to any port 80
sudo ufw allow from 192.168.1.0/24 to any port 443
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate XSS attacks.
- Use browser extensions that block XSS payloads for administrators accessing the interface.
🔍 How to Verify
Check if Vulnerable:
Check AdminLTE version via web interface dashboard or run 'pihole -v' and look for AdminLTE version below 5.8.Check Version:
pihole -v | grep 'AdminLTE'Verify Fix Applied:
After update, verify AdminLTE version is 5.8 or higher using 'pihole -v' command.📡 Detection & Monitoring
Log Indicators:
- Unusual client addition requests in Pi-hole logs
- Suspicious JavaScript payloads in web server access logs
Network Indicators:
- Unexpected outbound connections from Pi-hole server after web interface access
SIEM Query:
source="pi-hole" AND (event="client_added" OR url="*groups-clients*") AND user_agent="*<script>*"🔗 References
- https://github.com/pi-hole/AdminLTE/commit/01191c7a1b8d5032991ed9d88e0db8d3dbec744d
- https://github.com/pi-hole/AdminLTE/releases/tag/v5.8
- https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43
- https://github.com/pi-hole/AdminLTE/commit/01191c7a1b8d5032991ed9d88e0db8d3dbec744d
- https://github.com/pi-hole/AdminLTE/releases/tag/v5.8
- https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-mhr8-7rvg-8r43
