Vulnerability Description
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Benbusby | Whoogle Search | < 0.8.4 |
Related Weaknesses (CWE)
References
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f2Patch
- https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_wExploitThird Party Advisory
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209Product
- https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f2Patch
- https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_wExploitThird Party Advisory
FAQ
What is CVE-2024-22203?
CVE-2024-22203 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and ...
How severe is CVE-2024-22203?
CVE-2024-22203 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-22203?
Check the references section above for vendor advisories and patch information. Affected products include: Benbusby Whoogle Search.