PT-2024-19407 · Unknown · Whoogle Search

Sylwia Budzynska · Published 2024-01-18 · Updated 2024-03-14 · CVE-2024-22417

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Whoogle Search versions 0.8.3 and prior

Description Whoogle Search is a self-hosted metasearch engine. The element method in app/routes.py does not validate the user-controlled src type and element url variables and passes them to the send method which sends a GET request on lines 339-343 in requests.py. The returned contents of the URL are then passed to and reflected back to the user in the send file function on line 484, together with the user-controlled src type, which allows the attacker to control the HTTP response content type leading to a cross-site scripting vulnerability. An attacker could craft a special URL to point to a malicious website and send the link to a victim. The fact that the link would contain a trusted domain could be used to trick the user into clicking the link. The malicious website could, for example, be a copy of a real website, meant to steal a person’s credentials to the website, or trick that person in another way.

Recommendations Update to version 0.8.4 or later to patch the issue. As a temporary workaround, consider restricting access to the send file function and validating user-controlled input for src type and element url variables to minimize the risk of exploitation. Avoid using the element method in app/routes.py until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-22417

GHSA-PHG6-44M7-HX3H

PYSEC-2024-19

Affected Products

Whoogle Search

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22417.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search · Exploit
• https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda · Patch
• https://osv.dev/vulnerability/GHSA-phg6-44m7-hx3h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22417 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22417 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-19 · Vendor Advisory
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L476 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L484C6-L484C7 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466 · Note
• https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479 · Note
• https://github.com/benbusby/whoogle-search · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/whoogle-search/PYSEC-2024-19.yaml · Note