// For flags

CVE-2023-23614

Improper session handling of "Remember me for 7 days" functionality

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" cookie value makes it possible for an attacker to "pass the hash" to login or reuse a theoretically expired "remember me" cookie. It also exposes the hash over the network and stores it unnecessarily in the browser. The cookie itself is set to expire after 7 days but its value will remain valid as long as the admin password doesn't change. If a cookie is leaked or compromised it could be used forever as long as the admin password is not changed. An attacker that obtained the password hash via an other attack vector (for example a path traversal vulnerability) could use it to login as the admin by setting the hash as the cookie value without the need to crack it to obtain the admin password (pass the hash). The hash is exposed over the network and in the browser where the cookie is transmitted and stored. This issue is patched in version 5.18.3.

La interfaz web de Pi-hole® (basada en AdminLTE) proporciona una ubicación central para administrar su Pi-hole. Las versiones 4.0 y superiores, anteriores a la 5.18.3, son vulnerables a Insufficient Session Expiration. El uso inadecuado del hash WEBPASSWORD del administrador como valor de cookie "Recordarme durante 7 días" hace posible que un atacante realice "pass the hash" para iniciar sesión o reutilizar una cookie "recordarme" teóricamente caducada. También expone el hash a través de la red y lo almacena innecesariamente en el navegador. La cookie en sí caducará después de 7 días, pero su valor seguirá siendo válido siempre que la contraseña de administrador no cambie. Si una cookie se filtra o se ve comprometida, podría usarse para siempre siempre y cuando no se cambie la contraseña de administrador. Un atacante que obtuvo el hash de la contraseña a través de otro vector de ataque (por ejemplo, una vulnerabilidad de recorrido de ruta) podría usarlo para iniciar sesión como administrador estableciendo el hash como valor de la cookie sin necesidad de descifrarlo para obtener la contraseña del administrador (pase el picadillo). El hash se expone en la red y en el navegador donde se transmite y almacena la cookie. Este problema se solucionó en la versión 5.18.3.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-16 CVE Reserved
  • 2023-01-26 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-613: Insufficient Session Expiration
  • CWE-836: Use of Password Hash Instead of Password for Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Pi-hole
Search vendor "Pi-hole"
 Web Interface
Search vendor "Pi-hole" for product "Web Interface"
 >= 4.0 < 5.18.3
Search vendor "Pi-hole" for product "Web Interface" and version " >= 4.0 < 5.18.3"
-
Affected