Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2024-22203 EUVD-2024-0191GHSA-q97g-c29h-x2p7PYSEC-2024-20

Whoogle Search Server Side Request Forgery vulnerability

Published Jan 23, 2024 · Updated Nov 13, 2024 · Assigned by GitHub_M

Vendor: benbusby Product: whoogle-search Package: whoogle-search Ecosystem: PyPI

Description

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.

Affected products

VendorProductAffectedFixed
benbusby whoogle-search < 0.8.4 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI whoogle-search < 0.8.4 0.8.4 GHSA-q97g-c29h-x2p7

References