7

It's a well known fact that Flask's debug=True option can lead to remote code execution via werkzeug debugger capabilities and even several resources were hacked. I decided to look into it and it turned out that the technique doesn't work if the app is being run by a forking application server like uwsgi or gunicorn. So the questions are:

  1. Is there an opportunity to exploit Flask application with debug=True enabled even if it's being run by a forking application server (gunicorn, uwsgi)? I can't believe that all this hacked resources used built-in Flask's web server in production.
  2. Did all that hacked sites run Flask app directly without using "standard" approach like nginx + gunicorn/uwsgi + Flask?
  • The latest flask has a debugger PIN which prevents exploitation – paj28 Oct 24 '16 at 12:01
  • Sure, I'm aware of it. But let's assume it's disabled or older version of werkzeug is used. – CaptainRR Oct 24 '16 at 12:20
  • The Werkzeug debugger is WSGI middleware, so you can use it with any app server. You may have to jump through a couple of hoops to enable it (not sure, not done it myself). Also, I wouldn't be overly surprised if some sites were using the built-in dev server in production. – paj28 Oct 24 '16 at 12:38
3

If we enable the debugger with this code:

app = flask.Flask(__name__)
app.debug = True

That only enables the debugger with the built-in dev server. To use the Werkzeug debugger with another WSGI server, we have to explicitly include the middleware:

from werkzeug.debug import DebuggedApplication 
from waitress import serve
app = DebuggedApplication(app, evalex=True, pin_security=False)
serve(app, listen='*:8080')

When you do this, with evalex and pin_security options as above, the app is trivially vulnerable to remote compromise.

  • Thanks for the answer! I tested it and it really works with Waitress, however it doesn't work with gunicorn and uwsgi. – CaptainRR Oct 26 '16 at 9:19
  • @CaptainRR - Can you edit your question to include the exact config you're using – paj28 Oct 26 '16 at 13:34
  • Please find the whole test application at sendspace.com/file/hwvuk6 Just edit the Dockerfile for different configurations – CaptainRR Nov 7 '16 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.