CVE-2022-23513 Pi-Hole/AdminLTE vulnerable due to improper access control in queryads endpoint
Attackers can access blocked domain lists without authentication via the queryads endpoint, exposing personal blacklists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-23513?
CVE-2022-23513 is a medium-severity missing authorization vulnerability in pi-hole AdminLTE, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path: `/admin/scripts/pi-hole/phpqueryads.php.` Potential threat actor(s) are able to perform an unauthorized query search in blocked domain lists. This could lead to the disclosure for any victims' personal blacklists.
Weakness: CWE-284
Which versions are affected by CVE-2022-23513?
It affects 1 product.
Products include Pi-Hole Adminlte.
How do I fix CVE-2022-23513?
No fix has been published for CVE-2022-23513 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23513 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23513 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in pi-hole AdminLTE
Sources
Also known as GHSA-6qh8-6rrj-7497.