PT-2024-19272 · Unknown · Whoogle Search

Sylwia Budzynska · Published 2024-01-18 · Updated 2024-03-14 · CVE-2024-22204

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Whoogle Search versions 0.8.3 and prior

Description Whoogle Search is a self-hosted metasearch engine. The issue allows for a limited file write vulnerability when configuration options are enabled. The config function in app/routes.py does not validate the user-controlled name variable and config data variable, leading to path manipulation and a limited file write. The data saved is transformed into a dictionary with arbitrary data and a url key value pair before being saved on the system. This issue enables saving and overwriting files on the system with the application's permissions.

Recommendations For versions 0.8.3 and prior, update to version 0.8.4 to resolve the issue. As a temporary workaround, consider disabling the config function in app/routes.py until a patch is available. Restrict access to the configuration options in Whoogle to minimize the risk of exploitation. Avoid using the name variable and config data variable in the affected config function until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-22204

GHSA-HH2Q-QV66-JCQG

PYSEC-2024-23

Affected Products

Whoogle Search

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22204.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search · Exploit
• https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-22204 · Security Note
• https://osv.dev/vulnerability/GHSA-hh2q-qv66-jcqg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22204 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-23 · Vendor Advisory
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L437 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L444 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L447 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L419-L452 · Note
• https://github.com/benbusby/whoogle-search · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/whoogle-search/PYSEC-2024-23.yaml · Note
• https://twitter.com/GHSecurityLab/status/1748042447718842679 · Twitter Post
• https://twitter.com/CVEnew/status/1749846969105748455 · Twitter Post