CVE-2024-22204: Whoogle Search Path Traversal Vulnerability

CVE-2024-22204 Overview

CVE-2024-22204 is a limited file write vulnerability in Whoogle Search, a self-hosted metasearch engine maintained by benbusby. Versions 0.8.3 and prior fail to validate user-controlled input passed to the config function in app/routes.py. An unauthenticated attacker can manipulate the name parameter to traverse directories and overwrite files that the application has permission to write. The vulnerability is classified under CWE-22 (Path Traversal). Version 0.8.4 contains the patch.

Critical Impact
Remote attackers can overwrite arbitrary files writable by the Whoogle process with a Python pickle payload containing partially attacker-controlled data, potentially disrupting service or corrupting configuration.

Affected Products

Benbusby Whoogle Search versions 0.8.3 and prior
Self-hosted Whoogle instances exposing the /config endpoint
Docker and bare-metal deployments running vulnerable Whoogle builds

Discovery Timeline

2024-01-23 - CVE-2024-22204 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22204

Vulnerability Analysis

The flaw resides in the config route handler in app/routes.py. The handler accepts a POST parameter named name and concatenates it into a filesystem path using os.path.join without validation or sanitization. Because os.path.join treats absolute path components as replacements, an attacker who supplies a traversal sequence or absolute path can redirect the write to arbitrary locations. The config_data POST body is then serialized with pickle.dump and written to the resolved path.

The write is described as limited because Whoogle transforms the payload into a Python dictionary and injects a url key before serialization. Attackers therefore control most, but not all, of the pickled bytes on disk. Any file the Whoogle process user can write may be overwritten, including configuration files, cached data, or session material.

Root Cause

The root cause is missing input validation on user-supplied filename data combined with unsafe filesystem path construction. The config function does not enforce a whitelist of allowed configuration names, does not strip path separators, and does not canonicalize the resulting path against an expected base directory. This maps directly to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation is remote and unauthenticated when Whoogle configuration options are enabled and the /config endpoint is reachable. An attacker issues a crafted POST request to /config supplying a name value containing directory traversal characters and a config_data payload. The server serializes the payload with pickle.dump to the attacker-chosen filesystem path.

The official patch adds URL validation using the validators library and the re module in element and window endpoints. The commit diff below shows the imports introduced by the fix:

python

 import json
 import os
 import pickle
+import re
 import urllib.parse as urlparse
 import uuid
+import validators
 from datetime import datetime, timedelta
 from functools import wraps

Source: Whoogle Search patch commit 3a2e0b2

Detection Methods for CVE-2024-22204

Indicators of Compromise

POST requests to /config containing .., %2e%2e, or absolute path characters in the name parameter
Unexpected .pickle or dictionary-serialized files appearing outside the Whoogle configuration directory
Modification timestamps changing on Whoogle configuration or session files without an administrative action
Whoogle process errors when loading configuration after a write to an unintended path

Detection Strategies

Inspect web server and reverse proxy access logs for POST requests to /config with suspicious name values
Enable file integrity monitoring on the Whoogle application directory and any writable paths owned by the service user
Alert on Python pickle.dump writes originating from the Whoogle process to paths outside its expected working directory
Correlate anomalous configuration changes with the source IP and user agent of the requesting client

Monitoring Recommendations

Forward Whoogle application logs and reverse proxy logs to a centralized logging platform for retention and search
Track EPSS score changes for CVE-2024-22204, currently reported at 0.757%
Monitor upstream GitHub advisories, including GHSL-2023-186, for related disclosures

How to Mitigate CVE-2024-22204

Immediate Actions Required

Upgrade all Whoogle Search deployments to version 0.8.4 or later
Restrict network exposure of the /config endpoint using authentication proxies or firewall rules
Run the Whoogle process as an unprivileged user with write access limited to its configuration directory
Audit filesystem locations writable by the Whoogle service user for unexpected pickle files

Patch Information

The maintainer released a fix in commit 3a2e0b262e4a076a20416b45e6b6f23fd265aeda, included in Whoogle Search 0.8.4. The patch validates URLs and adds sanitization to affected endpoints. Review the official patch commit and the GitHub Security Lab advisory before deploying.

Workarounds

Disable Whoogle configuration features by unsetting WHOOGLE_CONFIG_DISABLE control variables where feasible
Place Whoogle behind a reverse proxy that enforces authentication on the /config path
Deploy Whoogle inside a read-only container filesystem, mounting only the configuration directory as writable
Apply web application firewall rules that reject POST parameters containing path traversal sequences

bash

# Upgrade Whoogle Search to the patched release
pip install --upgrade whoogle-search==0.8.4

# Or pull the patched Docker image
docker pull benbusby/whoogle-search:0.8.4
docker stop whoogle-search && docker rm whoogle-search
docker run --restart=always -p 5000:5000 \
  --read-only --tmpfs /tmp \
  -v whoogle-config:/config \
  benbusby/whoogle-search:0.8.4