Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-34361. PoCs published by T0X1Cx.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2024-34361, leveraging SSRF in Pi-hole to achieve RCE via Redis manipulation and Gopherus protocol. The exploit automates login, CSRF token extraction, payload delivery, and execution.
Description
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. A vulnerability in versions prior to 5.18.3 allows an authenticated user to make internal requests to the server via the `gravity_DownloadBlocklistFromUrl()` function. Depending on some circumstances, the vulnerability could lead to remote command execution. Version 5.18.3 contains a patch for this issue.
Exploits (1)
This repository contains a functional exploit for CVE-2024-34361, leveraging SSRF in Pi-hole to achieve RCE via Redis manipulation and Gopherus protocol. The exploit automates login, CSRF token extraction, payload delivery, and execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H