CVE-2025-34087: Pi-hole Command Injection RCE Vulnerability

CVE-2025-34087 Overview

CVE-2025-34087 is an authenticated command injection vulnerability in Pi-hole versions up to 3.3. The flaw resides in the legacy AdminLTE web interface, specifically in the allowlist domain-handling logic. When an authenticated user adds a domain through the web UI, the domain parameter is passed to an underlying shell context without proper sanitization. Attackers can append arbitrary operating system commands to the domain string, which the Pi-hole service then executes with the privileges of the Pi-hole service user. The issue is tracked as [CWE-78] (OS Command Injection) and has been addressed in later AdminLTE releases.

Critical Impact
Authenticated attackers can achieve remote code execution on the host running Pi-hole, gaining a foothold on the network's DNS resolver.

Affected Products

Pi-hole AdminLTE web interface versions up to and including 3.3
Pi-hole installations exposing the admin web UI to network-reachable users
Systems where the Pi-hole service user has command execution privileges on the host

Discovery Timeline

2025-07-03 - CVE-2025-34087 published to NVD
2025-10-01 - Last updated in NVD database

Technical Details for CVE-2025-34087

Vulnerability Analysis

The vulnerability exists in the allowlist handler of the legacy AdminLTE interface. The web UI accepts a domain parameter and forwards it to a shell-invoked backend routine that manages Pi-hole's allow/block lists. Because the parameter is concatenated into a command string without escaping or argument separation, shell metacharacters such as ;, |, and backticks are interpreted by the OS shell rather than treated as literal data. Any authenticated user with access to the allowlist function can therefore execute arbitrary OS commands. The Metasploit module exploits/unix/http/pihole_whitelist_exec automates this attack, and the EPSS probability of 72.184% (98.772 percentile) indicates active exploitation interest.

Root Cause

The root cause is missing input sanitization on the domain field submitted to the AdminLTE allowlist endpoint. The backend PHP code constructs a shell command using the unvalidated parameter, allowing attacker-controlled metacharacters to break out of the intended argument context. This is a classic [CWE-78] flaw where untrusted input flows directly into a privileged command interpreter.

Attack Vector

An attacker must first authenticate to the Pi-hole admin interface, either with stolen credentials, a weak admin password, or by leveraging a session on a network where the admin password is shared. After authentication, the attacker submits a crafted allowlist request containing a domain value followed by shell metacharacters and arbitrary commands. The injected commands run with the privileges of the Pi-hole service account, which on default installs has broad access to system binaries, DNS configuration, and network state. This pivot from the DNS resolver to the underlying Linux host enables credential theft, lateral movement, and persistent backdoors.

No verified proof-of-concept code is reproduced here. Technical details are available in the Pulse Security Advisory v3.3, the VulnCheck Pi-hole RCE Advisory, and the Metasploit Pi-hole Exploit module.

Detection Methods for CVE-2025-34087

Indicators of Compromise

HTTP POST requests to AdminLTE allowlist endpoints containing shell metacharacters such as ;, |, &, $(), or backticks in the domain parameter.
Unexpected child processes spawned by the web server or Pi-hole service user (for example sh, bash, nc, wget, curl, or python invocations).
New outbound network connections from the Pi-hole host to unfamiliar IP addresses shortly after allowlist modifications.
Modifications to /etc/pihole/, crontab entries, or SSH authorized_keys files not initiated by an administrator.

Detection Strategies

Inspect AdminLTE access logs for POST /admin/scripts/pi-hole/php/groups.php or whitelist.php requests containing non-domain characters in the domain field.
Correlate web request events with process-creation telemetry on the Pi-hole host to detect command execution chained from HTTP activity.
Apply YARA or regex rules against web server logs to flag known Metasploit payload signatures targeting the allowlist endpoint.

Monitoring Recommendations

Forward Pi-hole web server access logs and host process telemetry to a centralized SIEM or data lake for correlation.
Alert on any shell or interpreter process whose parent is lighttpd, php-fpm, or the Pi-hole service user.
Monitor authentication logs for brute-force attempts against the Pi-hole admin interface that could precede exploitation.

How to Mitigate CVE-2025-34087

Immediate Actions Required

Upgrade Pi-hole AdminLTE to version 4.0 or later, where the input sanitization fix is included.
Restrict access to the Pi-hole admin web interface to trusted management networks via firewall or reverse proxy ACLs.
Rotate the Pi-hole admin password and audit any accounts with web UI access.
Review the Pi-hole host for signs of post-exploitation activity, including unexpected cron jobs, SSH keys, and outbound connections.

Patch Information

The vulnerability is fixed in the AdminLTE web interface starting with version 4.0. Refer to the GitHub Release v4.0 for the upgrade artifact and changelog. Administrators should follow the official upgrade procedure documented at the Pi-hole Official Website.

Workarounds

Block external access to the /admin/ path entirely and require VPN or bastion access for management.
Place the Pi-hole web interface behind an authenticating reverse proxy that enforces multi-factor authentication.
Run the Pi-hole service under a least-privilege account and disable interactive shells for that user where feasible.

bash

# Example: restrict AdminLTE access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP

# Upgrade Pi-hole to pull the patched AdminLTE release
pihole -up