CVE-2024-53305: Whoogle Search Arbitrary Code Execution Vulnerability
Summary
CVE-2024-53305: Whoogle allows attackers to execute arbitrary code via supplying a crafted search query. Affects whoogle-search versions < 0.9.1. Fixed in 0.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Whoogle is an open-source self-hosted Google search alternative that allows users to search the web without tracking. It provides a privacy-focused search experience by stripping out tracking parameters and ads. However, a vulnerability in version 0.9.0 of Whoogle has been identified, which allows attackers to execute arbitrary code through crafted search queries, compromising the integrity of the application.
Vulnerability Detail
The vulnerability arises from improper handling of user-supplied input in the component /models/config.py of Whoogle search version 0.9.0. Attackers can exploit this flaw by crafting specific search queries that, when processed by the application, lead to arbitrary code execution. This could allow an attacker to gain unauthorized access to the server, manipulate data, or execute malicious commands, posing a significant risk to the application's security and the data it handles.
How To Fix
Minimum fixed version
0.9.1
This is the first release that contains the fix.
pip install --upgrade "whoogle-search==0.9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict input validation by sanitizing search queries to prevent execution of arbitrary code. However, this is not a complete fix and should only be used until the package is updated.
Conclusion
The vulnerability CVE-2024-53305 in Whoogle poses a significant risk by allowing arbitrary code execution through crafted search queries. It is crucial for users to update to version 0.9.1 or later to secure their installations. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for whoogle-search →
FAQ
CVE-2024-53305 is a vulnerability in Whoogle that allows attackers to execute arbitrary code via crafted search queries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to the server, potential data manipulation, and execution of malicious commands, which can compromise the entire application.
You can update Whoogle by running the command 'pip install --upgrade whoogle-search' in your terminal.
Yes, you can sanitize user input to prevent arbitrary code execution, but this is only a temporary workaround and not a full solution.
Related vulnerabilities
Recent vulnerabilities recorded for whoogle-search.
