CVE-2024-22203
Benbusby Whoogle Search vulnerability
- Published23 Jan 2024
Description
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NAffected products
Remediation
Frequently asked
Is CVE-2024-22203 being actively exploited?
CVE-2024-22203 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.01%.
How severe is CVE-2024-22203?
CVE-2024-22203 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 1.01% probability of exploitation.
Which products are affected by CVE-2024-22203?
Affected products include Benbusby Whoogle Search.
How do I fix CVE-2024-22203?
Upgrade affected software to a fixed version, for example Benbusby Whoogle Search 0.8.4 or later, then confirm no affected versions remain in your inventory.
How Secuno handles this
Secuno correlates vulnerabilities like CVE-2024-22203 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.
Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.