This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: Pi-hole Gravity updater has a code flaw allowing PHP file injection. ๐ฅ **Consequences**: Remote Code Execution (RCE) & Privilege Escalation to Root.โฆ
๐ก๏ธ **Root Cause**: Flaw in `gravity_DownloadBlocklistFromUrl` function. ๐ **CWE**: Not specified in data, but implies **Insecure File Write** / **Path Traversal** allowing arbitrary file creation.
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: Pi-hole versions **4.4 and earlier**. ๐งฉ **Component**: Gravity updater plugin. ๐ **Product**: Pi-hole (Network-level ad blocker).
Q4What can hackers do? (Privileges/Data)
๐ป **Hackers Can**: Execute arbitrary code. ๐๏ธ **Privileges**: Start as `www-data` user, then **escalate to Root**. ๐ **Data**: Full control over the server via injected PHP files.
Q5Is exploitation threshold high? (Auth/Config)
๐ **Threshold**: Low. โ ๏ธ **Auth**: Likely requires web access to the Pi-hole interface. ๐ก **Config**: Exploits the automatic update mechanism (Gravity). No complex setup needed for initial RCE.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ฅ **Public Exp**: YES. ๐ **PoC**: Available on GitHub (Frichetten). ๐ ๏ธ **Tools**: `cve-2020-11108-rce.py` (Shell as www-data) & `root-cve-2020-11108-rce.py` (Root shell). ๐ข **Status**: Actively exploited/documented.
Q7How to self-check? (Features/Scanning)
๐ **Check**: Scan for Pi-hole v4.4 or older. ๐ **Verify**: Look for unauthorized PHP files in web directories. ๐ก **Monitor**: Unusual network requests to blocklist URLs.โฆ
๐ **Fixed**: YES. ๐ **Date**: Published May 11, 2020. ๐ **Action**: Update Pi-hole to version **4.5+** or latest. ๐ก๏ธ **Official Patch**: Available via standard Pi-hole update commands.
Q9What if no patch? (Workaround)
๐ง **Workaround**: If unpatched, **disable Gravity updater** temporarily. ๐ **Restrict Access**: Block external access to Pi-hole web interface.โฆ
๐ด **Urgency**: HIGH. ๐จ **Priority**: Critical. ๐ฅ **Impact**: Full Server Compromise (Root). โณ **Time**: Exploits are public. ๐ก๏ธ **Action**: Patch IMMEDIATELY. Do not delay.