AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

Root

Cause AdGuard Home prior to version 0.107.73 contains an authentication bypass vulnerability due to improper handling of HTTP/2 cleartext (h2c) upgrades. The HTTP server is configured such that authentication middleware wraps an h2c handler at the outer layer, but when an h2c upgrade request is accepted, the h2c library hijacks the underlying TCP connection and serves subsequent HTTP/2 requests using the inner mux, which lacks authentication middleware [3]. This means that while the initial upgrade request may pass through authentication (often targeting a public path like /control/login), all subsequent HTTP/2 frames are processed without any credential verification.

Exploitation

An unauthenticated remote attacker can exploit this by sending a crafted HTTP/1.1 request with an Upgrade: h2c header to any AdGuard Home instance (default port 3000). Upon successful upgrade, the attacker can then send arbitrary HTTP/2 requests to any administrative endpoint, effectively bypassing all authentication mechanisms [2]. No prior access or credentials are required, and the attack can be carried out over the network.

Impact

A successful attack grants the attacker full administrative access to the AdGuard Home instance. This allows them to modify DNS filtering rules, view query logs, change configuration, and potentially exfiltrate sensitive network data. The CVSS score for this vulnerability is 9.8 (Critical), indicating high impact on confidentiality, integrity, and availability [3].

Mitigation

The vulnerability is fixed in AdGuard Home version 0.107.73 [1]. Users are strongly advised to update immediately. There are no known workarounds, as the issue stems from the core HTTP handling logic.