Vulnerabilidade de Server Side Request Forgery (SSRF) no Whoogle Search

This SSRF vulnerability allows an attacker to craft arbitrary GET requests through Whoogle Search, effectively leveraging the server as a proxy. The attacker can target internal resources that the Whoogle Search server has access to, even if those resources are not directly accessible from the outside world. This could include accessing sensitive internal APIs, databases, or other services. The potential impact extends beyond simple information disclosure; an attacker could potentially use this SSRF to interact with internal systems, triggering actions or exfiltrating data. The lack of proper input validation makes this a high-impact vulnerability, particularly in environments where Whoogle Search is used to access internal resources.

Organizations running self-hosted Whoogle Search instances, particularly those with internal services accessible via the server, are at risk. Shared hosting environments where Whoogle Search is deployed alongside other applications should be carefully assessed, as a compromised Whoogle Search instance could potentially be used to attack other services on the same server.

• python / server:

# Check for Whoogle Search version
python3 -c 'import whoogle; print(whoogle.__version__)'

• generic web:

curl -I http://your-whoogle-instance/element?src_type=image&element_url=http://169.254.169.254/ | grep Server

• generic web:

curl -I http://your-whoogle-instance/element?src_type=image&element_url=http://localhost:8080/ | grep Server

1. 2024-01-23Disclosure

   disclosure

1. Reservado2024-01-08
2. Publicada2024-01-23
3. Modificada2024-11-13
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-22203 is to immediately upgrade Whoogle Search to version 0.8.4 or later. This version includes the necessary fixes to validate user-controlled input and prevent the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block suspicious outbound requests originating from the Whoogle Search server. Restrict network access for the Whoogle Search server to only the necessary internal resources to limit the potential blast radius of a successful exploitation. Carefully review and audit any internal APIs or services that Whoogle Search might access.