CVE-2024-22203: Server-Side Request Forgery (SSRF) (CWE-918)
value: Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 9.8
Published: 2024-01-23T18:15Z
Repository: https://github.com/benbusby/whoogle-search
Language: Python
Files changed: app/routes.py
Commit date: 2023-09-13 15:50:04 -0600
Commit message: Validate urls in `element` and `window` endpoints

Domains were previously not validated before being handled, leading to a
potential scenario where someone could pass something like
"element_url=127.0.0.1:<port>/<resource>" to access other resources on a
machine running Whoogle. This change ensures that the resource used in
both endpoints is a valid domain.

This also includes validation of config names to prevent names from
including path values such as "../../(etc)".

Diff: diff --git a/app/routes.py b/app/routes.py
index 259e53a..5586a30 100644
--- a/app/routes.py
+++ b/app/routes.py
@@ -2,12 +2,14 @@ import argparse
 import base64
 import io
 import json
 import os
 import pickle
+import re
 import urllib.parse as urlparse
 import uuid
+import validators
 from datetime import datetime, timedelta
 from functools import wraps
 
 import waitress
 from app import app
@@ -418,17 +420,22 @@ def search():
 @auth_required
 def config():
     config_disabled = (
             app.config['CONFIG_DISABLE'] or
             not valid_user_session(session))
+
+    name = ''
+    if 'name' in request.args:
+        name = os.path.normpath(request.args.get('name'))
+        if not re.match(r'^[A-Za-z0-9_.+-]+$', name):
+            return make_response('Invalid config name', 400)
+
     if request.method == 'GET':
         return json.dumps(g.user_config.__dict__)
     elif request.method == 'PUT' and not config_disabled:
-        if 'name' in request.args:
-            config_pkl = os.path.join(
-                app.config['CONFIG_PATH'],
-                request.args.get('name'))
+        if name:
+            config_pkl = os.path.join(app.config['CONFIG_PATH'], name)
             session['config'] = (pickle.load(open(config_pkl, 'rb'))
                                  if os.path.exists(config_pkl)
                                  else session['config'])
             return json.dumps(session['config'])
         else:
@@ -442,11 +449,11 @@ def config():
         if 'name' in request.args:
             pickle.dump(
                 config_data,
                 open(os.path.join(
                     app.config['CONFIG_PATH'],
-                    request.args.get('name')), 'wb'))
+                    name), 'wb'))
 
         session['config'] = config_data
         return redirect(config_data['url'])
     else:
         return redirect(url_for('.index'), code=403)
@@ -461,10 +468,12 @@ def imgres():
 
 @app.route(f'/{Endpoint.element}')
 @session_required
 @auth_required
 def element():
+    empty_gif = base64.b64decode(
+        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')
     element_url = src_url = request.args.get('url')
     if element_url.startswith('gAAAAA'):
         try:
             cipher_suite = Fernet(g.session_key)
             src_url = cipher_suite.decrypt(element_url.encode()).decode()
@@ -473,22 +482,25 @@ def element():
                 'error.html',
                 error_message=str(e)), 401
 
     src_type = request.args.get('type')
 
+    # Ensure requested element is from a valid domain
+    domain = urlparse.urlparse(src_url).netloc
+    if not validators.domain(domain):
+        return send_file(io.BytesIO(empty_gif), mimetype='image/gif')
+
     try:
         file_data = g.user_request.send(base_url=src_url).content
         tmp_mem = io.BytesIO()
         tmp_mem.write(file_data)
         tmp_mem.seek(0)
 
         return send_file(tmp_mem, mimetype=src_type)
     except exceptions.RequestException:
         pass
 
-    empty_gif = base64.b64decode(
-        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')
     return send_file(io.BytesIO(empty_gif), mimetype='image/gif')
 
 
 @app.route(f'/{Endpoint.window}')
 @session_required
@@ -502,10 +514,17 @@ def window():
     content_filter = Filter(
         g.session_key,
         root_url=request.url_root,
         config=g.user_config)
     target = urlparse.urlparse(target_url)
+
+    # Ensure requested URL has a valid domain
+    if not validators.domain(target.netloc):
+        return render_template(
+            'error.html',
+            error_message='Invalid location'), 400
+
     host_url = f'{target.scheme}://{target.netloc}'
 
     get_body = g.user_request.send(base_url=target_url).text
 
     results = bsoup(get_body, 'html.parser')

Vulnerable code:         if 'name' in request.args:
            config_pkl = os.path.join(
                app.config['CONFIG_PATH'],
                request.args.get('name'))
                    request.args.get('name')), 'wb'))
    empty_gif = base64.b64decode(
        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')
Fixed code: import re
import validators

    name = ''
    if 'name' in request.args:
        name = os.path.normpath(request.args.get('name'))
        if not re.match(r'^[A-Za-z0-9_.+-]+$', name):
            return make_response('Invalid config name', 400)

        if name:
            config_pkl = os.path.join(app.config['CONFIG_PATH'], name)
                    name), 'wb'))
    empty_gif = base64.b64decode(
        'R0lGODlhAQABAIAAAP///////yH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==')
    # Ensure requested element is from a valid domain
    domain = urlparse.urlparse(src_url).netloc
    if not validators.domain(domain):
        return send_file(io.BytesIO(empty_gif), mimetype='image/gif')


    # Ensure requested URL has a valid domain
    if not validators.domain(target.netloc):
        return render_template(
            'error.html',
            error_message='Invalid location'), 400