CVE-2022-25303: Cross-site Scripting (XSS) in whoogle-search
Summary
CVE-2022-25303: The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. Affects whoogle-search across 2 version ranges.
< 0.7.2
< abc30d7da3b5c67be7ce84d4699f327442d44606
Fixed in abc30d7da3b5c67be7ce84d4699f327442d44606. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
whoogle-search is a Python package available on PyPI that provides a search engine interface for various search engines. It allows users to search for content without directly interacting with the search engine providers. This package is vulnerable to a Cross-site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability in whoogle-search exists in versions before 0.7.2. It is caused by the lack of proper input sanitization in the 'q' query string parameter. When the 'q' parameter does not contain the 'http' string, it is used to build the 'error_message' that is rendered in the 'error.html' template. The 'error_message' is rendered using the '| safe' filter, which means that user input is not properly escaped. This allows an attacker to inject malicious scripts into the rendered HTML, leading to potential XSS attacks.
How To Fix
Minimum fixed version
abc30d7da3b5c67be7ce84d4699f327442d44606
This is the first release that contains the fix.
pip install --upgrade "whoogle-search==abc30d7da3b5c67be7ce84d4699f327442d44606"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package as soon as possible.
Conclusion
The whoogle-search package before version 0.7.2 is vulnerable to Cross-site Scripting (XSS) attacks. It is crucial to upgrade to the fixed version to mitigate the risk of potential attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for whoogle-search →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Pipfile.lock file.
There is no known public exploit for this vulnerability at the moment. However, it is important to patch your systems to prevent any potential attacks.
There are no other similar vulnerabilities reported in whoogle-search at the moment. However, it is always recommended to keep your software up to date and follow best practices for secure coding.
You can find more information about this vulnerability in the advisory database of the Python Package Index (PyPI) at https://github.com/pypa/advisory-database/blob/main/vulns/whoogle-search/PYSEC-2022-226.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for whoogle-search.
