https://blog.mirch.io/tags/xss/ Recent content in xss on Rich Mirch Hugo en-us Thu, 24 Dec 2020 16:03:47 +0000 https://blog.mirch.io/2020/12/24/pihole-xss/ Thu, 24 Dec 2020 16:03:47 +0000 https://blog.mirch.io/2020/12/24/pihole-xss/ <p>Pi-hole v5.2.1 is vulnerable to a critical stored cross site scripting vulnerability. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator accesses the Query Log or Long-term Query Log pages on the web portal.</p> <p>The Pi-hole project released a fix on 12/24/2020 in v5.2.2. Shodan reports over 7,500 Pi-hole instances. This could be remotely exploited if these instances permit external DNS queries. Other possibilities may exist if a malformed DNS query is allowed.</p>