Is CVE-2024-22205 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-22205 being exploited in the wild.

How severe is CVE-2024-22205?

Low severity, with a CVSS score of 3.1, published 23 January 2024.

Which products and versions are affected?

whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.4, GIT:introduced=0,fixed=3a2e0b262e4a076a20416b45e6b6f23fd265aeda|ECOSYSTEM:introduced=0,fixed=0.8.4.

Is there a fix for CVE-2024-22205?

Yes. whoogle-search (PyPI): upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-22205 attacked?

It is attacked over the network.

Am I affected by CVE-2024-22205?

Check whether you run whoogle-search (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-22205: Whoogle Search server-side request forgery in window endpoint

CVE-2024-22205 · Severity: low · CVSS 3.1 · Published 2024-01-23

Whoogle Search is a self-hosted metasearch engine that aggregates results from multiple sources. An attacker can exploit an input validation flaw in the window endpoint to make the server perform HTTP requests to internal or external resources on the attacker's behalf, potentially exposing sensitive data from internal systems or facilitating attacks on trusted network resources.

Technologies: whoogle-search (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-22205 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-22205 being exploited in the wild.
How severe is CVE-2024-22205?: Low severity, with a CVSS score of 3.1, published 23 January 2024.
Which products and versions are affected?: whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.4, GIT:introduced=0,fixed=3a2e0b262e4a076a20416b45e6b6f23fd265aeda|ECOSYSTEM:introduced=0,fixed=0.8.4.
Is there a fix for CVE-2024-22205?: Yes. whoogle-search (PyPI): upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-22205 attacked?: It is attacked over the network.
Am I affected by CVE-2024-22205?: Check whether you run whoogle-search (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

whoogle-search (PyPI): upgrade to 0.8.4 or later
```
pip install "whoogle-search>=0.8.4"
```

Technical details

The vulnerability is a server-side request forgery (SSRF) caused by insufficient input validation of the location parameter in the window endpoint (lines 339–343 in request.py). The location variable is passed directly to an HTTP GET request without sanitization. An attacker can craft a request with a malicious location parameter (e.g., "element_url=127.0.0.1:<port>/<resource>") to access internal network resources, bypass network boundaries, or interact with services that are not directly accessible from the internet. No authentication is required; the vulnerability is reachable over the network. The issue was fixed in version 0.8.4 by adding URL validation to ensure only valid domains are processed.

Affected products

benbusby whoogle-search 0.8.3 and prior

Identifiers

CVE-2024-22205
GHSA-3q6g-qmpx-rqw4
PYSEC-2024-18

Timeline

2024-01-23: disclosed: NVD publication date
2024-03-14: patched: Fixed in version 0.8.4

References

https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.