Flask debug=True exploitation

Question

It's a well known fact that Flask's debug=True option can lead to remote code execution via werkzeug debugger capabilities and even several resources were hacked. I decided to look into it and it turned out that the technique doesn't work if the app is being run by a forking application server like uwsgi or gunicorn. So the questions are:

1. Is there an opportunity to exploit Flask application with debug=True enabled even if it's being run by a forking application server (gunicorn, uwsgi)? I can't believe that all this hacked resources used built-in Flask's web server in production.
2. Did all that hacked sites run Flask app directly without using "standard" approach like nginx + gunicorn/uwsgi + Flask?

Answer 1

If we enable the debugger with this code:

app = flask.Flask(__name__)
app.debug = True

That only enables the debugger with the built-in dev server. To use the Werkzeug debugger with another WSGI server, we have to explicitly include the middleware:

from werkzeug.debug import DebuggedApplication 
from waitress import serve
app = DebuggedApplication(app, evalex=True, pin_security=False)
serve(app, listen='*:8080')

When you do this, with evalex and pin_security options as above, the app is trivially vulnerable to remote compromise.