CVE-2024-22205
📋 TL;DR
This vulnerability in Whoogle Search allows attackers to perform server-side request forgery (SSRF) by exploiting unsanitized user input in the 'window' endpoint. Attackers can craft requests to access internal network resources or external systems that the server can reach. All users running Whoogle Search versions 0.8.3 and earlier are affected.
💻 Affected Systems
- Whoogle Search
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network resources, data exfiltration, or using the server as a proxy for attacks against other systems.
Likely Case
Unauthorized access to internal services, metadata harvesting, or scanning of internal network resources.
If Mitigated
Limited to accessing only allowed external resources if proper input validation and network segmentation are implemented.
🎯 Exploit Status
The vulnerability is straightforward to exploit with basic HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.4
Vendor Advisory: https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda
Restart Required: Yes
Instructions:
1. Update Whoogle Search to version 0.8.4 or later. 2. Restart the Whoogle Search service. 3. Verify the update by checking the version.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allRemove or block access to the '/window' endpoint that contains the vulnerability.
Modify app/routes.py to comment out or remove the vulnerable route
Network segmentation
allRestrict Whoogle Search server's network access to only required external resources.
Configure firewall rules to limit outbound connections from the Whoogle server
🧯 If You Can't Patch
- Implement strict network segmentation to limit the server's access to internal resources.
- Deploy a web application firewall (WAF) with SSRF protection rules.
🔍 How to Verify
Check if Vulnerable:
Check if Whoogle Search version is 0.8.3 or earlier and if the '/window' endpoint is accessible.Check Version:
Check the Whoogle Search interface or configuration files for version information.Verify Fix Applied:
Confirm version is 0.8.4 or later and test that SSRF attempts via the '/window' endpoint are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to the '/window' endpoint with crafted 'location' parameters
- Outbound requests from Whoogle server to internal IP addresses or unusual domains
Network Indicators:
- Whoogle server making unexpected HTTP requests to internal network ranges
- Traffic patterns suggesting the server is being used as a proxy
SIEM Query:
source="whoogle.log" AND (uri_path="/window" AND location=*) OR (src_ip="whoogle_server_ip" AND dst_ip="internal_range")🔗 References
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L496-L557
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L497
- https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda
- https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search/
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L496-L557
- https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L497
- https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda
- https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search/
