Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection
Vulnerability Description
FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web interface. From 6.0 to before 6.6, the Pi-hole FTL engine contains a Remote Code Execution (RCE) vulnerability in the upstream DNS servers configuration parameter (dns.upstreams). This vulnerability allows an authenticated attacker to inject arbitrary dnsmasq configuration directives through newline characters, ultimately achieving command execution on the underlying system. This vulnerability is fixed in 6.6.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Vulnerability Title
FTL 注入漏洞
Vulnerability Description
FTL是Pi-hole开源的一个网络广告拦截与统计工具。 FTL 6.0至6.6之前版本存在注入漏洞，该漏洞源于上游DNS服务器配置参数存在注入漏洞，可能导致经过身份验证的攻击者通过换行符注入任意dnsmasq配置指令，最终在底层系统上执行命令。
CVSS Information
N/A
Vulnerability Type
N/A