CVE-2021-32793 Stored XSS Vulnerability in the Pi-hole Webinterface

Medium 5.7 Published 4 Aug 2021 Updated 3 Aug 2024

A stored XSS vulnerability in the Pi-hole web interface allows remote attackers to execute scripts in administrative sessions via malicious domain entries.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-32793?

CVE-2021-32793 is a medium-severity cross-site scripting vulnerability in pi-hole AdminLTE, published on 4 Aug 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain, this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.

Weakness: CWE-79

Which versions are affected by CVE-2021-32793?

It affects 1 product.

Products include Pi-Hole Pi-Hole.

How do I fix CVE-2021-32793?

No fix has been published for CVE-2021-32793 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-32793 being exploited?

There is no known exploitation of CVE-2021-32793 in the wild and no public exploit code.

Sources

Also known as GHSA-g3w6-q4fg-p8x8.