Description
Whoogle search是一个自托管、无广告、尊重隐私的元搜索引擎。Whoogle search v0.9.0 的/models/config.py 中存在一个问题，允许攻击者通过提供精心设计的搜索查询来执行任意代码。
Whoogle search 代码执行漏洞（CVE-2024-53305）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-53305
https://github.com/advisories/GHSA-2689-cw26-6cpj
https://www.cvedetails.com/cve/CVE-2024-53305/
https://www.miggo.io/vulnerability-database/cve/CVE-2024-53305
https://advisories.gitlab.com/pypi/whoogle-search/CVE-2024-53305/
https://www.tenable.com/cve/CVE-2024-53305
https://avd.aquasec.com/nvd/2024/cve-2024-53305/
https://gist.github.com/fern89/ca5fe76ad81b4bc363e7341e523a1651
https://fern89.github.io/posts/whoogle-rce