p PatchFirst

CVE-2024-22417

CVE-2024-22417 · Whoogle Search Cross-site Scripting vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a `GET` request on lines 339-343 in `requests.py`. The returned contents of the URL are then passed to and reflected back to the user in the `send_file` function on line 484, together with the user-controlled `src_type`, which allows the attacker to control the HTTP response content type leading to a cross-site scripting vulnerability. An attacker could craft a special URL to point to a malicious website and send the link to a victim. The fact that the link would contain a trusted domain (e.g. from one of public Whoogle instances) could be used to trick the user into clicking the link. The malicious website could, for example, be a copy of a real website, meant to steal a person’s credentials to the website, or trick that person in another way. Version 0.8.4 contains a patch for this issue.

CVSS 6.1 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • whoogle-search

    Versions
    • < 0.8.4: Affected

    No fix published

  • whoogle-search PyPI

    Versions
    • 0.1.0
    • 0.1.3
    • 0.1.4
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.6.0
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    Affected ranges
    • ECOSYSTEM: < 0.8.4

    Update to 0.8.4

  • whoogle-search PyPI

    Versions
    • 0.1.0
    • 0.1.3
    • 0.1.4
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.6.0
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.8.0
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • v0.8.3
    • v0.8.2
    • v0.8.1
    • v0.8.0
    • v0.7.4
    • v0.7.3
    • v0.7.2
    • v0.7.1
    • v0.7.0
    • v0.6.0
    • v0.5.4
    • v0.5.3
    • v0.5.2
    • v0.5.1
    • v0.5.0
    • v0.4.1
    • v0.4.0
    • v0.3.2
    • v0.3.1
    • v0.3.0
    • v0.1.4
    • v0.1.3
    • v0.1.2
    • v0.1.1
    • v0.1.0
    • v0.0.1
    Affected ranges
    • GIT: < 3a2e0b262e4a076a20416b45e6b6f23fd265aeda
    • ECOSYSTEM: < 0.8.4

    Update to 0.8.4

Original sources

Check your server →