CVE-2024-22203: 
Python vulnerability analysis and mitigation

Whoogle Search, a self-hosted metasearch engine, was found to contain a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 0.8.4. The vulnerability exists in the element method in app/routes.py where user-controlled src_type and element_url variables are not properly validated before being passed to the send method (NVD, GitHub Security Lab).

The vulnerability stems from insufficient validation of user input in the element method within app/routes.py. The method passes unvalidated user-controlled variables to the send method, which then makes GET requests on lines 339-343 in request.py. The CVSS v3.1 base score is 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H according to NVD's assessment (NVD).

This vulnerability allows attackers to craft GET requests to both internal and external resources on behalf of the server. An attacker could potentially access resources on the internal network that the server has access to, even if these resources are not accessible from the internet (GitHub Security Lab).

The vulnerability has been fixed in version 0.8.4 of Whoogle Search. The fix includes validation of URLs in the element and window endpoints to ensure that only valid domains are processed before handling requests (GitHub Patch).