CVE-2024-22205 Whoogle Search Server Side Request Forgery vulnerability
An attacker can exploit unsanitized input in the window endpoint to force the server to make GET requests to internal or external resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22205?
CVE-2024-22205 is a critical server-side request forgery vulnerability in benbusby whoogle-search, published on 23 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on lines 339-343 in `request.py,` which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
Weakness: CWE-918
Which versions are affected by CVE-2024-22205?
3 open source packages ship an affected version, including whoogle-search. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
whoogle-search PyPI | All versions | 0.8.4 |
whoogle-search PyPI | All versions | 0.8.4 |
whoogle-search PyPI | All versions | 0.8.4 |
Products include Benbusby Whoogle Search.
How do I fix CVE-2024-22205?
Upgrade whoogle-search to 0.8.4 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-22205 being exploited?
There is no known exploitation of CVE-2024-22205 in the wild and no public exploit code.
Other vulnerabilities in benbusby whoogle-search
- CVE-2024-22203 Whoogle Search Server Side Request Forgery vulnerability
- CVE-2024-53305 Whoogle allows attackers to execute arbitrary code via supplying a crafted search query
- CVE-2024-22417 Whoogle Search Cross-site Scripting vulnerability
- CVE-2024-22204 Whoogle Search Limited File Write vulnerability
Sources
Also known as GHSA-3q6g-qmpx-rqw4, PYSEC-2024-18.