CVE-2024-22204: 
Python vulnerability analysis and mitigation

Whoogle Search versions 0.8.3 and prior contain a limited file write vulnerability when the configuration options are enabled. The vulnerability was discovered in January 2024 and affects the self-hosted metasearch engine (GitHub Advisory).

The vulnerability exists in the config function in app/routes.py where two user-controlled variables are not properly validated: the name variable on line 447 and config_data variable on line 437. The name variable is insecurely concatenated in os.path.join, which leads to path manipulation. Additionally, the POST data from the config_data variable is saved using pickle.dump, resulting in a limited file write capability (GitHub Advisory).

The vulnerability allows an attacker to save and overwrite files on the system that the application has permissions to access. The written files will contain a dictionary with arbitrary data and a required 'url' key-value pair, resulting in a limited file write capability (GitHub Advisory).

The vulnerability can only be exploited when the configuration options in Whoogle are enabled. The attacker needs to be able to interact with the configuration endpoint to exploit this vulnerability (GitHub Advisory).

The vulnerability has been patched in version 0.8.4. Users should upgrade to this version or later to mitigate the risk. The patch includes validation of config names to prevent names from including path values such as "../../(etc)" (GitHub Commit).