CVE-2024-22205 — AI Deep Analysis Summary

🚨 **Essence**: Whoogle-search < 0.8.4 has a Server-Side Request Forgery (SSRF) flaw.…

🔍 **CWE-918**: SSRF. 🐛 **Flaw**: The `/window` endpoint fails to sanitize user input from the `location` variable. 🔄 This unsanitized input is directly passed to the `send` method, allowing arbitrary URL injection.…

🏷️ **Vendor**: benbusby. 📦 **Product**: Whoogle-search. 📅 **Affected**: Versions **prior to 0.8.4**. ✅ **Fixed**: Version 0.8.4 and later. 🌐 Self-hosted privacy-respecting meta-search engine.

🕵️ **Hackers Can**: Forge server-side requests to internal networks (e.g., metadata services, internal APIs). 📂 **Data Impact**: **High** Confidentiality (read sensitive data) and **High** Integrity (modify data).…

⚡ **Threshold**: **LOW**. 🚫 **Auth**: None required (PR:N). 👁️ **UI**: None required (UI:N). 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). Easy to exploit remotely without credentials.

📜 **Public Exp?**: No specific PoC code provided in the data. 🔗 **References**: GitHub Security Lab (GHSL-2023-186) confirmed the issue.…

🔎 **Check**: Scan for Whoogle-search instances. 🕵️ **Test**: Send crafted requests to the `/window` endpoint with malicious `location` parameters.…

🛡️ **Fixed**: Yes! Upgrade to **Whoogle-search 0.8.4** or newer. 📥 **Source**: GitHub repository `benbusby/whoogle-search`. 🔒 **Patch**: Input sanitization added to the `window` endpoint logic.…

🚧 **No Patch?**: Restrict network access to the `/window` endpoint. 🚫 **Block**: Prevent the server from making outbound requests to internal ranges.…

🔥 **Urgency**: **HIGH**. 📈 **CVSS**: 9.8 (Critical). 🚨 **Risk**: Remote, unauthenticated, easy exploit. ⏳ **Action**: Patch immediately! Do not wait. Internal network exposure is a major threat.