CVE-2024-22203
📋 TL;DR
This vulnerability allows attackers to perform server-side request forgery (SSRF) in Whoogle Search, enabling them to make unauthorized GET requests to internal and external resources from the server. Anyone running Whoogle Search versions before 0.8.4 is affected, particularly those with internet-facing instances or access to sensitive internal networks.
💻 Affected Systems
- Whoogle Search
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources, data exfiltration from internal systems, and potential lateral movement to other systems accessible from the server.
Likely Case
Unauthorized access to internal services, metadata harvesting from cloud environments, and potential credential theft from internal APIs.
If Mitigated
Limited to external resource access only, with internal network segmentation preventing access to sensitive systems.
🎯 Exploit Status
The vulnerability is straightforward to exploit with basic HTTP requests and requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.4
Vendor Advisory: https://github.com/benbusby/whoogle-search/releases/tag/v0.8.4
Restart Required: Yes
Instructions:
1. Stop the Whoogle Search service. 2. Update to version 0.8.4 using pip: 'pip install whoogle-search==0.8.4'. 3. Restart the service.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from the Whoogle Search server to only necessary external resources.
Input Validation
allAdd URL validation to reject non-whitelisted domains in the element endpoint.
🧯 If You Can't Patch
- Implement strict network egress filtering to block requests to internal IP ranges and sensitive domains.
- Deploy a web application firewall (WAF) with SSRF protection rules to block malicious requests.
🔍 How to Verify
Check if Vulnerable:
Check if the 'element' endpoint accepts arbitrary URLs without validation by testing with internal IP addresses.Check Version:
pip show whoogle-search | grep VersionVerify Fix Applied:
Test that the 'element' endpoint now validates URLs and rejects requests to internal resources.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from Whoogle server to internal IPs
- Requests to metadata endpoints (169.254.169.254, etc.)
Network Indicators:
- Unexpected outbound HTTP traffic from Whoogle server to internal networks
- Requests to cloud metadata services
SIEM Query:
source="whoogle.log" AND (dst_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) OR url CONTAINS "element")🔗 References
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L476
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479
- https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda
- https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search/
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L476
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479
- https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda
- https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search/
