Executive brief
Whoogle is a privacy-focused search engine metasearch application. An attacker can execute arbitrary code on the server by submitting a specially crafted search query that exploits insecure deserialization in the configuration handling. This could allow complete compromise of the Whoogle instance, including access to user data and the ability to modify search results.
Technical details
Whoogle v0.9.0 and earlier versions contain a remote code execution vulnerability in the /models/config.py component caused by the use of Python's insecure pickle.loads() function for deserializing configuration data. An unauthenticated remote attacker can supply a malicious search query containing crafted pickle payloads that trigger arbitrary code execution on the server. The vulnerability requires no authentication or user interaction beyond submitting the search query. The fix, released in version 0.9.1, replaces pickle serialization with JSON, which is safe by design.
Affected products
- Whoogle whoogle-search 0.1.0 through 0.9.0
Timeline
- 2025-04-16: disclosed
- 2025-04-16: patched: Fixed in version 0.9.1