Executive brief
Whoogle Search is a self-hosted metasearch engine that aggregates results from multiple sources. An attacker can exploit an input validation flaw in the window endpoint to make the server perform HTTP requests to internal or external resources on the attacker's behalf, potentially exposing sensitive data from internal systems or facilitating attacks on trusted network resources.
Technical details
The vulnerability is a server-side request forgery (SSRF) caused by insufficient input validation of the location parameter in the window endpoint (lines 339–343 in request.py). The location variable is passed directly to an HTTP GET request without sanitization. An attacker can craft a request with a malicious location parameter (e.g., "element_url=127.0.0.1:<port>/<resource>") to access internal network resources, bypass network boundaries, or interact with services that are not directly accessible from the internet. No authentication is required; the vulnerability is reachable over the network. The issue was fixed in version 0.8.4 by adding URL validation to ensure only valid domains are processed.
Affected products
- benbusby whoogle-search 0.8.3 and prior
Timeline
- 2024-01-23: disclosed: NVD publication date
- 2024-03-14: patched: Fixed in version 0.8.4