# CVE-2024-22205: Whoogle Search server-side request forgery in window endpoint

Source: https://junglewise.ai/threats/cve-2024-22205-whoogle-search-server-side-request-forgery-in-window-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-22205 · Severity: low · CVSS 3.1 · Published 2024-01-23

Whoogle Search is a self-hosted metasearch engine that aggregates results from multiple sources. An attacker can exploit an input validation flaw in the window endpoint to make the server perform HTTP requests to internal or external resources on the attacker's behalf, potentially exposing sensitive data from internal systems or facilitating attacks on trusted network resources.

Technologies: [whoogle-search (PyPI)](https://junglewise.ai/threats/technologies/pypi-whoogle-search). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-22205 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-22205 being exploited in the wild.

**How severe is CVE-2024-22205?** Low severity, with a CVSS score of 3.1, published 23 January 2024.

**Which products and versions are affected?** whoogle-search (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.4, GIT:introduced=0,fixed=3a2e0b262e4a076a20416b45e6b6f23fd265aeda|ECOSYSTEM:introduced=0,fixed=0.8.4.

**Is there a fix for CVE-2024-22205?** Yes. whoogle-search (PyPI): upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-22205 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-22205?** Check whether you run whoogle-search (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- whoogle-search (PyPI): upgrade to 0.8.4 or later

  ```sh
  pip install "whoogle-search>=0.8.4"
  ```


## Technical details

The vulnerability is a server-side request forgery (SSRF) caused by insufficient input validation of the location parameter in the window endpoint (lines 339–343 in request.py). The location variable is passed directly to an HTTP GET request without sanitization. An attacker can craft a request with a malicious location parameter (e.g., "element_url=127.0.0.1:<port>/<resource>") to access internal network resources, bypass network boundaries, or interact with services that are not directly accessible from the internet. No authentication is required; the vulnerability is reachable over the network. The issue was fixed in version 0.8.4 by adding URL validation to ensure only valid domains are processed.

## Affected products

- benbusby whoogle-search 0.8.3 and prior

## Identifiers

- CVE-2024-22205
- GHSA-3q6g-qmpx-rqw4
- PYSEC-2024-18

## Timeline

- 2024-01-23: disclosed: NVD publication date
- 2024-03-14: patched: Fixed in version 0.8.4

## References

- [https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda](https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda)

## Related threats

- [PYSEC-2026-2048 - Whoogle allows attackers to execute arbitrary code via supplying a crafted search query](https://junglewise.ai/threats/cve-2024-53305-whoogle-arbitrary-code-execution-via-crafted-search-query)
- [Whoogle Search Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-22204-whoogle-search-path-traversal-vulnerability)
- [Whoogle Search Path Traversal vulnerability](https://junglewise.ai/threats/cve-2024-22203-whoogle-search-path-traversal-vulnerability)
- [Whoogle Search Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-22417-whoogle-search-cross-site-scripting-vulnerability)
- [Whoogle Search Cross-site Scripting via string parameter](https://junglewise.ai/threats/cve-2022-25303-whoogle-search-cross-site-scripting-via-string-parameter)