The Harmless Pi-Hole Bug

A bug bounty hunter recently explored a vulnerability in the Pi-hole software, an open-source ad blocker that functions as a DNS server. The investigation focused on the api.php file, which allows users to modify settings without proper authentication checks. The researcher discovered that while most files implemented security measures, api.php contained an endpoint that could execute a command to change the CPU temperature format displayed on the status page. Although this vulnerability was deemed inconsequential, the researcher reported it to the Pi-hole team, who acknowledged it but did not classify it as a significant security issue. The maintainers indicated that the flaw would be addressed in a future version. The researcher subsequently submitted a pull request to enhance security by adding an authentication check, which was accepted. The vulnerability has been assigned CVE-2024-44069, although it is currently marked as disputed due to differing opinions on its severity. This experience reinforced the researcher's appreciation for the Pi-hole project and sparked further interest in source code review.

- The researcher identified a minor vulnerability in the Pi-hole software's api.php file.

- The vulnerability allowed unauthenticated users to change the CPU temperature display format.

- The Pi-hole team acknowledged the issue but did not consider it a significant security risk.

- The researcher contributed a fix that was accepted into the project's development branch.

- The vulnerability has been assigned a CVE number but is marked as disputed.