CVE-2024-22204

Executive Summary

CVE-2024-22204 is a limited file write vulnerability in Whoogle Search, a self-hosted metasearch engine. The flaw resides in the config function within app/routes.py, where user-controlled name and config_data variables are not properly validated. The name variable is insecurely concatenated in os.path.join, enabling path traversal, while config_data is serialized using pickle.dump, allowing arbitrary file writes. Although the written data is transformed into a dictionary with a forced url key, an attacker can overwrite application files or write new ones, potentially leading to code execution or configuration tampering. The vulnerability affects versions 0.8.3 and prior, with a patch released in version 0.8.4. The EPSS score is 0.0%, indicating low exploitation likelihood, but the self-hosted nature of Whoogle makes it a target for targeted attacks.

Supply Chain & Package Security

Whoogle Search is a Python-based PyPI package (whoogle-search). The vulnerability is introduced in the source code, not via a dependency. However, the use of pickle.dump is a dangerous practice as it can lead to deserialization attacks if the file is later loaded. The patch in version 0.8.4 adds input validation, but users should also consider using safer serialization formats like JSON. The package is distributed via PyPI, and users should verify the integrity of the installed package using checksums or signed commits.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Limited file write capability.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability allows limited file writes, which can be chained with other weaknesses (e.g., overwriting configuration files or templates) to achieve code execution. The low EPSS score suggests it is not widely exploited, but targeted attacks are possible.

Deep Dive & Mechanics

The vulnerability is in the config function of app/routes.py. The function accepts POST data to update configuration settings. Two key variables are mishandled:

1. name variable (line 447): This is used to construct the file path via os.path.join. Without validation, an attacker can supply a name like ../../etc/passwd to traverse directories and overwrite arbitrary files.

2. config_data variable (line 437): This is serialized using pickle.dump and written to the file specified by name. Although the data is transformed into a dictionary with a forced url key, the attacker controls the rest of the dictionary content. This allows writing arbitrary data to the file, limited only by the dictionary structure.

The attack flow:

• Attacker sends a POST request to /config with name=../../app/templates/index.html and config_data={"malicious": "content"}.
• The server constructs the path as os.path.join(config_dir, "../../app/templates/index.html"), resolving to the templates directory.
• The config_data is converted to a dictionary with url key added, then written via pickle.dump.
• The attacker can overwrite template files to inject malicious content (e.g., XSS or phishing forms).

The limited nature comes from the forced url key, but this still allows significant manipulation of application behavior.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.8.3):

# app/routes.py (simplified)
@app.route('/config', methods=['POST'])
def config():
    name = request.form.get('name')
    config_data = request.form.get('config_data')
    config_path = os.path.join(config_dir, name)
    with open(config_path, 'wb') as f:
        pickle.dump(config_data, f)

Patched Code (version 0.8.4):

# app/routes.py (simplified)
import re

@app.route('/config', methods=['POST'])
def config():
    name = request.form.get('name')
    config_data = request.form.get('config_data')
    # Validate name to prevent path traversal
    if not re.match(r'^[a-zA-Z0-9_\-]+$', name):
        return "Invalid name", 400
    config_path = os.path.join(config_dir, name)
    # Validate config_data structure
    if not isinstance(config_data, dict):
        return "Invalid config data", 400
    with open(config_path, 'wb') as f:
        pickle.dump(config_data, f)

The patch adds regex validation for name (alphanumeric, underscores, hyphens only) and type checking for config_data. This prevents directory traversal and ensures only valid configuration data is written.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Whoogle Search version 0.8.3 or earlier running on a target.
• Network access to the /config endpoint.

Exploitation Steps:

1. Identify Target: Use Shodan dorks to find exposed Whoogle instances.
2. Craft Payload: Create a POST request to overwrite a template file with malicious content.

   curl -X POST http://target:5000/config \
     -d "name=../../app/templates/index.html" \
     -d "config_data={\"malicious\": \"<script>alert('XSS')</script>\"}"
   

3. Trigger Payload: Access the overwritten template to execute the injected script.
4. Escalate: Overwrite configuration files to disable security features or enable remote code execution.

Advanced Exploitation:

• Use pickle deserialization to execute arbitrary code if the file is later loaded with pickle.load.
• Chain with other vulnerabilities (e.g., SSRF) to expand impact.

Blue Team

Detection:

• Monitor for POST requests to /config with unusual name parameters (e.g., containing ../).
• Alert on file writes outside the expected configuration directory.
• Use file integrity monitoring (FIM) to detect changes to application files.

Hunting:

• Search logs for os.path.join errors or file write operations to unexpected paths.
• Analyze network traffic for anomalous POST data to /config.

Mitigation:

• Immediately upgrade to version 0.8.4 or later.
• If upgrade is not possible, apply a WAF rule to block path traversal patterns in name parameter.
• Restrict file system permissions to prevent the application from writing to sensitive directories.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /config with name containing ../ or absolute paths.
  • Unusual config_data values containing script tags or base64-encoded payloads.
• File System:
  • Unexpected modifications to files in app/templates/, app/static/, or other application directories.
  • New files created in the application root with suspicious content.
• Logs:
  • Errors related to os.path.join or file write failures.
  • Repeated requests to /config from the same IP.

Detection Engineering

YARA Rule

rule CVE_2024_22204_Whoogle_FileWrite {
    meta:
        description = "Detects exploitation attempts of CVE-2024-22204 in Whoogle Search"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-22204"
    strings:
        $path_traversal = /name=\.\.\// nocase
        $config_data = /config_data=.*\{.*\}/ nocase
        $pickle_dump = /pickle\.dump/ nocase
    condition:
        any of them
}

Sigma Rule

title: Whoogle Search CVE-2024-22204 File Write Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /config with path traversal in name parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /config
        cs-uri-query|contains: 'name=../'
    condition: selection
falsepositives:
    - Legitimate configuration changes with unusual paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22204 Whoogle Search File Write Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/config"; http.client_body; content:"name=../"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Upgrade: Update Whoogle Search to version 0.8.4 or later. Use pip:

   pip install --upgrade whoogle-search
   

2. Configuration Hardening: If upgrade is not possible, restrict access to the /config endpoint using a reverse proxy (e.g., Nginx) with IP whitelisting.
3. File System Permissions: Run Whoogle with a dedicated user that has minimal write permissions. Use chmod to make critical directories read-only.
4. Input Validation: Implement additional input validation at the reverse proxy level to block path traversal patterns.
5. Monitoring: Enable detailed logging and set up alerts for file modifications in the application directory.
6. Alternative Serialization: Consider replacing pickle with JSON for configuration storage to reduce deserialization risks.

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2024-22204