CVE-2022-23513 : Security Advisory and Response

Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint.

Understanding CVE-2022-23513

Pi-Hole/AdminLTE is affected by a vulnerability due to improper access control in the

queryads

endpoint, potentially allowing threat actors to perform unauthorized queries for blocked domains.

What is CVE-2022-23513?

Pi-Hole is a network-wide ad blocking tool that runs on Linux hardware, while AdminLTE serves as a dashboard for Pi-Hole statistics. The vulnerability in question arises from a lack of validation in the code at

/admin/scripts/pi-hole/phpqueryads.php

, enabling unauthorized queries for blocked domains.

The Impact of CVE-2022-23513

Exploitation of this vulnerability could grant threat actors the ability to access and search through blocked domain lists, potentially leading to the exposure of victims' personal blacklists.

Technical Details of CVE-2022-23513

Vulnerability Description

The vulnerability allows unauthorized queries for blocked domains via the

queryads

endpoint, facilitated by a lack of input validation in the root server path.

Affected Systems and Versions

Pi-Hole's AdminLTE version prior to 5.17 is affected by this vulnerability.

Exploitation Mechanism

Threat actors can exploit this vulnerability to perform unauthorized searches in blocked domain lists, compromising the security and privacy of users.

Mitigation and Prevention

Immediate Steps to Take

Users are advised to update Pi-Hole's AdminLTE to version 5.17 or higher to mitigate the vulnerability. Additionally, restricting access to the

queryads

endpoint can help prevent unauthorized queries.

Long-Term Security Practices

Regularly monitoring for security advisories and promptly applying updates can help maintain the security of Pi-Hole and AdminLTE installations.

Patching and Updates

Ensure that you stay informed about security updates released by Pi-Hole and promptly apply patches to address known vulnerabilities.