CVE-2024-22203: Whoogle Search SSRF Vulnerability

CVE-2024-22203 Overview

CVE-2024-22203 is a server-side request forgery (SSRF) vulnerability in Whoogle Search, a self-hosted metasearch engine. The flaw exists in versions prior to 0.8.4, where the element method in app/routes.py fails to validate the user-controlled src_type and element_url parameters. These unvalidated values are passed to the send method in request.py, which issues a GET request to the supplied URL. Attackers can craft requests that force the server to reach internal network resources or arbitrary external endpoints. This issue is tracked as [CWE-918] and is fixed in version 0.8.4.

Critical Impact
Unauthenticated attackers can coerce the Whoogle Search server into issuing arbitrary GET requests, including to internal services not exposed to the internet.

Affected Products

Benbusby Whoogle Search versions prior to 0.8.4
Self-hosted Whoogle Search deployments behind internal networks
Container-based Whoogle Search instances with network access to private resources

Discovery Timeline

2024-01-23 - CVE-2024-22203 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-22203

Vulnerability Analysis

The vulnerability resides in the element route handler in app/routes.py (lines 465-490). The handler accepts the user-supplied src_type and element_url query parameters without validating their values, scheme, or destination host. These parameters flow directly into the send method in request.py (lines 339-343), which performs a server-side GET request.

Because Whoogle Search executes the outbound request from its own network context, an attacker can target hosts that are reachable only from the server. This includes cloud metadata services, internal admin interfaces, and other intranet endpoints. The server returns response content to the requester, enabling data exfiltration in addition to blind probing.

Root Cause

The root cause is missing input validation on URL parameters consumed by an outbound HTTP client. The pre-patch code did not check whether element_url pointed to an allowed host, scheme, or content type. The fix introduces validators and re based checks to constrain accepted URLs before they reach the send method.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the /element endpoint with element_url pointing at an internal resource such as http://169.254.169.254/latest/meta-data/ on cloud deployments or internal services like http://127.0.0.1:8080/admin. The Whoogle server fetches the resource and returns the content to the attacker.

python

 import json
 import os
 import pickle
+import re
 import urllib.parse as urlparse
 import uuid
+import validators
 from datetime import datetime, timedelta
 from functools import wraps

Source: Whoogle Search Patch Commit 3a2e0b2

The patch imports re and validators to enforce URL validation in the element and window endpoints before any outbound request is issued.

Detection Methods for CVE-2024-22203

Indicators of Compromise

Inbound HTTP requests to /element containing element_url parameters pointing at private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) or link-local addresses such as 169.254.169.254.
Outbound HTTP requests from the Whoogle Search host to cloud metadata endpoints or internal management interfaces.
Unexpected GET requests originating from the Whoogle server toward non-search-related destinations.

Detection Strategies

Inspect web server and reverse proxy logs for /element requests where element_url is not a known external image or asset host.
Correlate Whoogle process network telemetry against an allowlist of expected upstream search providers.
Apply web application firewall rules that block requests to the element endpoint containing internal IP literals or non-HTTP(S) schemes.

Monitoring Recommendations

Monitor egress traffic from Whoogle Search containers for connections to RFC1918 ranges and cloud metadata IPs.
Alert on anomalous spikes in /element request volume or response sizes returned to a single client.
Track Whoogle Search version banners across the environment to confirm deployments are running 0.8.4 or later.

How to Mitigate CVE-2024-22203

Immediate Actions Required

Upgrade Whoogle Search to version 0.8.4 or later on every self-hosted instance.
Restrict outbound network access from the Whoogle host to only the domains required for search functionality.
Place Whoogle Search behind an authenticating reverse proxy if it is exposed beyond a trusted network.

Patch Information

The fix is delivered in commit 3a2e0b262e4a076a20416b45e6b6f23fd265aeda and is included in Whoogle Search 0.8.4. The patch adds URL validation in the element and window endpoints using the validators library and regular expression checks. See the GitHub Security Advisory GHSL-2023-186 for full advisory details.

Workarounds

Block external access to the /element and /window routes at a reverse proxy until the upgrade is applied.
Deploy Whoogle Search in a network segment with no route to internal services or cloud metadata endpoints.
Enforce egress firewall rules that deny traffic from the Whoogle host to private address space.

bash

# Example nginx configuration to block the vulnerable endpoints until patched
location ~ ^/(element|window) {
    return 403;
}