CVE-2024-22417 Whoogle Search Cross-site Scripting vulnerability

What is CVE-2024-22417?

CVE-2024-22417 is a medium-severity cross-site scripting vulnerability in benbusby whoogle-search, published on 23 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a `GET` request on lines 339-343 in `requests.py`. The returned contents of the URL are then passed to and reflected back to the user in the `send_file` function on line 484, together with the user-controlled `src_type`, which allows the attacker to control the HTTP response content type leading to a cross-site scripting vulnerability. An attacker could craft a special URL to point to a malicious website and send the link to a victim. The fact that the link would contain a trusted domain (e.g. from one of public Whoogle instances) could be used to trick the user into clicking the link. The malicious website could, for example, be a copy of a real website, meant to steal a person’s credentials to the website, or trick that person in another way. Version 0.8.4 contains a patch for this issue.

Weakness: CWE-79

Which versions are affected by CVE-2024-22417?

3 open source packages ship an affected version, including whoogle-search. It affects 1 product.

Products include Benbusby Whoogle Search.

How do I fix CVE-2024-22417?

Upgrade whoogle-search to 0.8.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-22417 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22417 exists.

Other vulnerabilities in benbusby whoogle-search

• CVE-2024-22203 Whoogle Search Server Side Request Forgery vulnerability Critical 9.1
• CVE-2024-22205 Whoogle Search Server Side Request Forgery vulnerability Critical 9.1
• CVE-2024-53305 Whoogle allows attackers to execute arbitrary code via supplying a crafted search query High 7.3
• CVE-2024-22204 Whoogle Search Limited File Write vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-phg6-44m7-hx3h, PYSEC-2024-19.