CVE-2024-34361: Pi-hole DNS Sinkhole RCE Vulnerability

CVE-2024-34361 Overview

CVE-2024-34361 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Pi-hole, the DNS sinkhole used to block unwanted content network-wide. The flaw exists in the gravity_DownloadBlocklistFromUrl() function in versions prior to 5.18.3. An authenticated user can supply arbitrary URLs to this function, causing the Pi-hole server to issue internal requests on their behalf. Depending on the runtime environment and protocol handlers available to curl, the SSRF can escalate to remote command execution. Version 5.18.3 addresses the issue by validating that submitted URLs use an allowed protocol.

Critical Impact
An authenticated attacker can coerce the Pi-hole host into making arbitrary internal requests through the blocklist download function, with a path to remote command execution under certain configurations.

Affected Products

Pi-hole versions prior to 5.18.3
Pi-hole gravity.sh blocklist download component
Deployments exposing the Pi-hole admin interface to authenticated users

Discovery Timeline

2024-07-05 - CVE-2024-34361 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34361

Vulnerability Analysis

Pi-hole's gravity subsystem downloads blocklists from URLs supplied by administrators through the web interface. The gravity_DownloadBlocklistFromUrl() function in gravity.sh passes the user-supplied URL directly to curl without validating the protocol scheme. This creates a classic Server-Side Request Forgery condition where the Pi-hole host, rather than the client, initiates outbound requests to attacker-chosen destinations.

Because curl supports a broad set of protocol handlers beyond HTTP, an attacker can leverage schemes such as file://, gopher://, dict://, or scp:// to reach loopback services, read local files, or interact with internal network endpoints. In configurations where the underlying curl build supports command-invoking protocols, this SSRF becomes a vector for remote command execution on the Pi-hole host.

Root Cause

The root cause is missing input validation on the URL protocol scheme before invocation of curl. The vulnerable code accepts any string as a URL and delegates protocol handling entirely to curl. There is no allowlist restricting schemes to safe web transports, so unexpected handlers execute with the privileges of the Pi-hole service.

Attack Vector

An authenticated user with access to the Pi-hole admin interface submits a crafted blocklist URL. When gravity runs, the Pi-hole host issues the request. Attackers can use this to pivot to internal services, exfiltrate local files, or invoke command-executing curl protocols. Exploitation requires low privileges and no user interaction beyond authentication.

bash

     fi
   fi
 
+  # Check for allowed protocols
+  if [[ $url != "http"* && $url != "https"* && $url != "file"* && $url != "ftp"* && $url != "ftps"* && $url != "sftp"* ]]; then
+    echo -e "${OVER}  ${CROSS} ${str} Invalid protocol specified, ignoring list"
+    download=false
+  fi
+
   if [[ "${download}" == true ]]; then
     # shellcheck disable=SC2086
     httpCode=$(curl --connect-timeout ${curl_connect_timeout} -s -L ${compression} ${cmd_ext} ${heisenbergCompensator} -w "%{http_code}" "${url}" -o "${listCurlBuffer}" 2> /dev/null)

Source: Pi-hole security commit 2c497a9. The patch adds an explicit protocol allowlist, rejecting URLs whose scheme is not http, https, file, ftp, ftps, or sftp.

Detection Methods for CVE-2024-34361

Indicators of Compromise

Blocklist entries in the Pi-hole configuration referencing non-standard protocol schemes such as gopher://, dict://, scp://, or file://.
Unexpected curl child processes spawned by gravity.sh targeting internal or loopback addresses.
Outbound connections from the Pi-hole host to internal RFC1918 endpoints coinciding with gravity execution.

Detection Strategies

Inspect the Pi-hole adlist database for URL entries whose scheme is outside the standard web set.
Correlate gravity invocation timestamps with process execution logs to identify curl calls to unusual destinations.
Monitor administrative activity on the Pi-hole web interface for unauthorized additions to blocklist sources.

Monitoring Recommendations

Enable audit logging on the Pi-hole admin interface and alert on new blocklist URL submissions.
Restrict outbound network egress from the Pi-hole host so that only expected blocklist providers are reachable.
Review pihole -g execution logs for entries flagged with the new Invalid protocol specified message after upgrade.

How to Mitigate CVE-2024-34361

Immediate Actions Required

Upgrade Pi-hole to version 5.18.3 or later, which contains the protocol validation patch.
Audit existing blocklist URLs and remove any entries not using http or https schemes.
Rotate credentials for Pi-hole administrative accounts and review who has authenticated access.

Patch Information

Pi-hole 5.18.3 introduces a scheme allowlist in gravity.sh restricting downloads to http, https, file, ftp, ftps, and sftp. Details are available in the Pi-hole GitHub Security Advisory GHSA-jg6g-rrj6-xfg6 and the corresponding upstream commit.

Workarounds

Restrict access to the Pi-hole admin interface to trusted management networks only.
Enforce strong authentication and unique passwords on all Pi-hole administrative accounts.
Apply host-level egress firewall rules that limit outbound connections from the Pi-hole server to known blocklist domains.