CVE-2022-25303: Whoogle Search Cross-site Scripting via string parameter
(updated )
The package whoogle-search before version 0.7.2 is vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the flask.render_template function. However, the error_message is rendered using the | safe filter, meaning the user input is not escaped.
References
- github.com/advisories/GHSA-mxvc-fwgx-j778
- github.com/benbusby/whoogle-search
- github.com/benbusby/whoogle-search/blob/6d362ca5c7a00d2f691a2512461c5dfbfc01cbb3/app/routes.py%23L448
- github.com/benbusby/whoogle-search/commit/abc30d7da3b5c67be7ce84d4699f327442d44606
- github.com/pypa/advisory-database/tree/main/vulns/whoogle-search/PYSEC-2022-226.yaml
- nvd.nist.gov/vuln/detail/CVE-2022-25303
- snyk.io/vuln/SNYK-PYTHON-WHOOGLESEARCH-2803306
Code Behaviors & Features
Detect and mitigate CVE-2022-25303 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →