Whoogle allows attackers to execute arbitrary code via supplying a crafted search query

Description

References

• nvd.nist.gov/vuln/detail/CVE-2024-53305 · ADVISORY
• benbusby/whoogle-search commit 223f00c · WEB
• fern89.github.io/posts/whoogle-rce · WEB
• gist.github.com/fern89/ca5fe76ad81b4bc363e7341e523a1651 · WEB
• benbusby/whoogle-search · PACKAGE
• pypi.org/project/whoogle-search · PACKAGE
• GitHub Advisory GHSA-2689-cw26-6cpj · ADVISORY

More vulnerabilities in whoogle-search

• CVE-2024-22417MEDIUM 6.1Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate th…
• CVE-2024-22205CRITICAL 9.8Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input …
• CVE-2024-22204MEDIUM 5.3Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration o…
• CVE-2024-22203CRITICAL 9.8Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the…
• CVE-2022-25303MEDIUM 6.1The package whoogle-search before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it …