Pi-Hole Web 6.x < 6.4.2 (Core) Local Privilege Escalation (CVE-2026-41489)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(321187);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/16");

  script_cve_id("CVE-2026-41489");

  script_name(english:"Pi-Hole Web 6.x < 6.4.2 (Core) Local Privilege Escalation (CVE-2026-41489)");

  script_set_attribute(attribute:"synopsis", value:
"An ad-blocking DNS server web-based admin interface on the remote host is affected by a local privilege escalation
vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported Core version, the Pi-Hole instance on the remote host is running a Core version
between 6.0 and prior to 6.4.2. It is, therefore, affected by a local privilege escalation vulnerability:

  - Two shell scripts executed as root by systemd (pihole-FTL-prestart.sh and pihole-FTL-poststop.sh) read the
    files.pid path from config without validation and use it in privileged file operations. By writing an arbitrary
    path into files.pid, an attacker with pihole privilege can cause root to delete and then recreate any file on the
    system outside the ProtectSystem=full-restricted directories, gaining write access to it. On a default
    installation this yields local privilege escalation to root via SSH authorized keys manipulation.
    (CVE-2026-41489)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/pi-hole/pi-hole/security/advisories/GHSA-6w8x-p785-6pm4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1476f3b0");
  script_set_attribute(attribute:"solution", value:
"Upgrade Pi-Hole Core to version 6.4.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41489");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pi-hole:pi-hole");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("pihole_web_detect.nbin");
  script_require_keys("installed_sw/Pi-Hole Web");

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'Pi-Hole Web';

get_install_count(app_name:app, exit_if_zero:TRUE);

var port = get_http_port(default:443);
var install = get_single_install(app_name:app, port:port, exit_if_unknown_ver:FALSE);

var core_version = install['Core Version'];

if (empty_or_null(core_version) || core_version == UNKNOWN_VER)
  audit(AUDIT_UNKNOWN_APP_VER, 'Pi-Hole Core');

if (ver_compare(ver:core_version, fix:'6.0', strict:FALSE) < 0 ||
    ver_compare(ver:core_version, fix:'6.4.2', strict:FALSE) >= 0)
  audit(AUDIT_HOST_NOT, 'affected');

var report =
  '\n  Installed Core version : ' + core_version +
  '\n  Fixed Core version     : 6.4.2' +
  '\n';

security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);