8

It's a well known fact that Flask's debug=True option can lead to remote code execution via werkzeug debugger capabilities and even several resources were hacked. I decided to look into it and it turned out that the technique doesn't work if the app is being run by a forking application server like uwsgi or gunicorn. So the questions are:

  1. Is there an opportunity to exploit Flask application with debug=True enabled even if it's being run by a forking application server (gunicorn, uwsgi)? I can't believe that all this hacked resources used built-in Flask's web server in production.
  2. Did all that hacked sites run Flask app directly without using "standard" approach like nginx + gunicorn/uwsgi + Flask?
Improve this question
3
  • The latest flask has a debugger PIN which prevents exploitation
    – paj28
    Oct 24, 2016 at 12:01
  • Sure, I'm aware of it. But let's assume it's disabled or older version of werkzeug is used.
    – CaptainRR
    Oct 24, 2016 at 12:20
  • The Werkzeug debugger is WSGI middleware, so you can use it with any app server. You may have to jump through a couple of hoops to enable it (not sure, not done it myself). Also, I wouldn't be overly surprised if some sites were using the built-in dev server in production.
    – paj28
    Oct 24, 2016 at 12:38

1 Answer 1

Reset to default
3

If we enable the debugger with this code:

app = flask.Flask(__name__)
app.debug = True

That only enables the debugger with the built-in dev server. To use the Werkzeug debugger with another WSGI server, we have to explicitly include the middleware:

from werkzeug.debug import DebuggedApplication 
from waitress import serve
app = DebuggedApplication(app, evalex=True, pin_security=False)
serve(app, listen='*:8080')

When you do this, with evalex and pin_security options as above, the app is trivially vulnerable to remote compromise.

Improve this answer
3
  • Thanks for the answer! I tested it and it really works with Waitress, however it doesn't work with gunicorn and uwsgi.
    – CaptainRR
    Oct 26, 2016 at 9:19
  • @CaptainRR - Can you edit your question to include the exact config you're using
    – paj28
    Oct 26, 2016 at 13:34
  • Please find the whole test application at sendspace.com/file/hwvuk6 Just edit the Dockerfile for different configurations
    – CaptainRR
    Nov 7, 2016 at 9:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .