Summary
A command injection vulnerability in Pi-hole's PID-file handling can cause root-run Bash logic to evaluate attacker-controlled content as an arithmetic expression. An attacker who already has code execution as the pihole user may be able to escalate privileges to root when a vulnerable subcommand reads the manipulated PID file.
A command injection vulnerability in Pi-hole's PID-file handling can cause root-run Bash logic to evaluate attacker-controlled content as an arithmetic expression. An attacker who already has code execution as the pihole user may be able to escalate privileges to root when a vulnerable subcommand reads the manipulated PID file.
Affected context
The issue occurs in Pi-hole deployments where the root-run subcommands use the
pihole-owned /run/pihole-FTL.pid file and rely on incomplete validation of
its contents. The risk is present when an attacker can execute code as the
pihole user and write to that PID file before a privileged Bash arithmetic
comparison processes its value.
The issue occurs in Pi-hole deployments where the root-run subcommands use the
pihole-owned /run/pihole-FTL.pid file and rely on incomplete validation of
its contents. The risk is present when an attacker can execute code as the
pihole user and write to that PID file before a privileged Bash arithmetic
comparison processes its value.
Exploit preconditions
- Attack surface: Local interaction with Pi-hole's PID-file handling
- Required access: Existing code execution or equivalent write capability as the pihole user
- Trigger point: A root-run Pi-hole subcommand that reads and evaluates the PID value
- Why exploitation is possible: Validation rejects only values beginning with a non-digit, while Bash arithmetic evaluation can interpret specially structured digit-prefixed content and perform command substitution
- Attack surface: Local interaction with Pi-hole's PID-file handling
- Required access: Existing code execution or equivalent write capability as the pihole user
- Trigger point: A root-run Pi-hole subcommand that reads and evaluates the PID value
- Why exploitation is possible: Validation rejects only values beginning with a non-digit, while Bash arithmetic evaluation can interpret specially structured digit-prefixed content and perform command substitution
Why this happens
The underlying flaw combines incomplete input validation with unsafe use of
attacker-influenced data in a Bash arithmetic expression. The validation
checks only the first character rather than requiring the entire PID value to
match a strict numeric format. As a result, content that appears to begin
like a valid PID can still be interpreted by Bash as executable expression
syntax, which maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The underlying flaw combines incomplete input validation with unsafe use of
attacker-influenced data in a Bash arithmetic expression. The validation
checks only the first character rather than requiring the entire PID value to
match a strict numeric format. As a result, content that appears to begin
like a valid PID can still be interpreted by Bash as executable expression
syntax, which maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- An attacker may execute commands with root privileges
- The Pi-hole host could be fully compromised
- DNS filtering and resolution behavior could be altered
- Local credentials, configuration, or protected data could be exposed
- The compromised host could be used for lateral movement or persistence
- An attacker may execute commands with root privileges
- The Pi-hole host could be fully compromised
- DNS filtering and resolution behavior could be altered
- Local credentials, configuration, or protected data could be exposed
- The compromised host could be used for lateral movement or persistence
General mitigation guidance
Mitigation generally focuses on treating PID-file contents as strictly
untrusted data and preventing shell evaluation from interpreting them as
code.
Common defensive patterns include:
- Require the complete PID value to match a narrowly defined decimal-integer schema
- Parse and compare process identifiers using non-shell APIs or safely typed operations
- Avoid arithmetic evaluation of data that can be modified by a less-privileged account
- Use ownership, permissions, and protected runtime directories to limit PID-file modification
- Separate privileged operations from inputs writable by service accounts
- Apply least privilege to Pi-hole processes and constrain root-run helper behavior
- Treat validation as a full-string check performed before any interpretation or comparison
Mitigation generally focuses on treating PID-file contents as strictly
untrusted data and preventing shell evaluation from interpreting them as
code.
Common defensive patterns include:
- Require the complete PID value to match a narrowly defined decimal-integer schema
- Parse and compare process identifiers using non-shell APIs or safely typed operations
- Avoid arithmetic evaluation of data that can be modified by a less-privileged account
- Use ownership, permissions, and protected runtime directories to limit PID-file modification
- Separate privileged operations from inputs writable by service accounts
- Apply least privilege to Pi-hole processes and constrain root-run helper behavior
- Treat validation as a full-string check performed before any interpretation or comparison
How teams detect issues like this
Detection can combine source review, runtime monitoring, and policy enforcement.
Useful approaches include:
- Static analysis rules for arithmetic evaluation, command substitution, and
shell expansion involving file-derived variables
- Code review checks for validation expressions that inspect only a prefix or
first character of security-sensitive values
- Searches for privileged shell commands consuming files writable by service
accounts
- File-integrity monitoring on PID files and other privileged runtime metadata
- Alerts for unexpected root-child processes launched by Pi-hole helpers
- CI policies that reject shell arithmetic or dynamic evaluation of untrusted
input; automated code-review tools may assist with identifying these patterns
Detection can combine source review, runtime monitoring, and policy enforcement.
Useful approaches include:
- Static analysis rules for arithmetic evaluation, command substitution, and
shell expansion involving file-derived variables
- Code review checks for validation expressions that inspect only a prefix or
first character of security-sensitive values
- Searches for privileged shell commands consuming files writable by service
accounts
- File-integrity monitoring on PID files and other privileged runtime metadata
- Alerts for unexpected root-child processes launched by Pi-hole helpers
- CI policies that reject shell arithmetic or dynamic evaluation of untrusted
input; automated code-review tools may assist with identifying these patterns
