CVE-2025-32785
📋 TL;DR
This vulnerability allows authenticated Pi-hole users to inject malicious JavaScript into the Address field when managing subscribed lists. When another user performs a gravity database update, the malicious script executes in their browser session. This affects all Pi-hole installations running web interface versions before 6.3.
💻 Affected Systems
- Pi-hole Admin Interface
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious user could steal admin session cookies, perform actions as the admin, or redirect users to malicious sites, potentially compromising the entire Pi-hole configuration.
Likely Case
An authenticated user with limited privileges could escalate privileges by stealing admin session tokens or performing unauthorized actions within the Pi-hole interface.
If Mitigated
With proper access controls limiting authenticated users and regular patching, impact is limited to potential session hijacking between authenticated users.
🎯 Exploit Status
Exploitation requires authenticated access to the web interface and another user performing a gravity update. The vulnerability is stored XSS that triggers on specific admin actions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3
Vendor Advisory: https://github.com/pi-hole/web/security/advisories/GHSA-7w6h-3gwc-qhq5
Restart Required: No
Instructions:
1. Update Pi-hole web interface to version 6.3 or later using: pihole -up
2. Verify update completed successfully
3. No service restart required - changes take effect immediately
🔧 Temporary Workarounds
Restrict User Access
allLimit authenticated user access to only trusted administrators until patching can be completed.
🧯 If You Can't Patch
- Disable non-admin user accounts and restrict web interface access to trusted administrators only
- Implement network segmentation to isolate Pi-hole management interface from general user access
🔍 How to Verify
Check if Vulnerable:
Check Pi-hole web interface version via Admin Interface → Settings → System tab, or run: pihole -v | grep 'AdminLTE'Check Version:
pihole -v | grep 'AdminLTE'Verify Fix Applied:
Confirm AdminLTE version is 6.3 or higher using: pihole -v | grep 'AdminLTE'📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript payloads in gravity update logs
- Multiple failed authentication attempts followed by list management actions
Network Indicators:
- Unusual outbound connections from Pi-hole server after gravity updates
- Suspicious JavaScript in HTTP POST requests to list management endpoints
SIEM Query:
source="pi-hole" AND ("gravity update" OR "list management") AND ("script" OR "javascript" OR "<script>")