CVE-2024-22203 Whoogle Search Server Side Request Forgery vulnerability
Attacker can force the server to make requests to internal or external resources, potentially accessing private network data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22203?
CVE-2024-22203 is a critical server-side request forgery vulnerability in benbusby whoogle-search, published on 23 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
Weakness: CWE-918
Which versions are affected by CVE-2024-22203?
3 open source packages ship an affected version, including whoogle-search. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
whoogle-search PyPI | All versions | 0.8.4 |
whoogle-search PyPI | All versions | 0.8.4 |
whoogle-search PyPI | All versions | 0.8.4 |
Products include Benbusby Whoogle Search.
How do I fix CVE-2024-22203?
Upgrade whoogle-search to 0.8.4 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-22203 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22203 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in benbusby whoogle-search
- CVE-2024-22205 Whoogle Search Server Side Request Forgery vulnerability
- CVE-2024-53305 Whoogle allows attackers to execute arbitrary code via supplying a crafted search query
- CVE-2024-22417 Whoogle Search Cross-site Scripting vulnerability
- CVE-2024-22204 Whoogle Search Limited File Write vulnerability
Sources
Also known as GHSA-q97g-c29h-x2p7, PYSEC-2024-20.