The Pi-hole Admin Interface is vulnerable to CRLF injection, which permits unauthenticated attackers to manipulate HTTP responses and bypass critical browser security protections.

This vulnerability involves Improper Neutralization of CRLF Sequences (CWE-93) and HTTP Response Splitting (CWE-113) occurring when requests are made to files with the .lp extension. The interface fails to sanitize input during redirects, allowing an unauthenticated attacker to inject arbitrary HTTP headers.

Successful exploitation allows an attacker to manipulate HTTP headers, potentially leading to session fixation, cache poisoning, and the circumvention of security controls like Content Security Policy. With a CVSS score of 8.2, this flaw poses a high risk to the integrity of web sessions and the effectiveness of browser-based security mechanisms, which could facilitate more complex attacks against administrative users.

Immediate Action: Update the Pi-hole web interface to version 6.3 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web access logs for anomalous requests containing URL-encoded carriage return (%0d) or line feed (%0a) characters directed at .lp files.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block HTTP requests containing CRLF sequences in parameters to prevent exploitation until the software can be updated.

Public Exploit Available: Unknown.

Given the potential for session hijacking and the bypass of browser security policies, this vulnerability represents a significant risk to administrative control over the Pi-hole instance. Administrators should prioritize the update to version 6.3 immediately to eliminate the underlying injection flaw and restore secure header handling.