CVE-2024-28247: Arbitrary File Access in Pi-hole

An attacker exploiting this vulnerability could gain unauthorized access to internal Pi-hole server files. Because Pi-hole typically runs with elevated privileges, this access could expose sensitive configuration data, API keys, or other credentials used by the system. While the vulnerability requires authentication, a compromised user account or a successful brute-force attack could provide the necessary access. The potential impact extends beyond simple data exposure; an attacker could potentially modify configuration files to redirect DNS queries or inject malicious content, disrupting network services and compromising user privacy. The ability to read privileged files elevates the risk significantly, potentially allowing for further exploitation and lateral movement within the network.

1. Reserved2024-03-07
2. Published2024-03-27
3. Modified2024-08-13
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-28247 is to upgrade Pi-hole to version 5.18 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility concerns or system downtime requirements, consider restricting access to the Pi-hole web interface to trusted users only. Implement strong password policies and multi-factor authentication to prevent unauthorized access. Review Pi-hole's access control lists (ACLs) to ensure that only authorized users have access to sensitive features. Monitor Pi-hole logs for any suspicious activity, such as attempts to access unauthorized files. While a WAF is unlikely to directly mitigate this vulnerability, it can help detect and block malicious requests targeting the affected endpoint.