benbusby whoogle-search up to 0.8.3 GET Request request.py send location server-side request forgery

Summaryinfo

A vulnerability categorized as critical has been discovered in benbusby whoogle-search up to 0.8.3. Affected by this issue is the function send of the file request.py of the component GET Request Handler. The manipulation of the argument location results in server-side request forgery. This vulnerability was named CVE-2024-22205. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in benbusby whoogle-search up to 0.8.3. Affected is the function send of the file request.py of the component GET Request Handler. The manipulation of the argument location with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on lines 339-343 in `request.py,` which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.

The weakness was presented 01/23/2024 as GHSL-2023-186. The advisory is shared for download at securitylab.github.com. This vulnerability is traded as CVE-2024-22205 since 01/08/2024. There are known technical details, but no exploit is available.

Upgrading to version 0.8.4 eliminates this vulnerability. Applying the patch 3a2e0b262e4a076a20416b45e6b6f23fd265aeda is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• benbusby

Name

• whoogle-search

Version

• 0.8.0
• 0.8.1
• 0.8.2
• 0.8.3

License

• open-source

Website

• Product: https://github.com/benbusby/whoogle-search/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion