It's a well known fact that Flask's debug=True
option can lead to remote code execution via werkzeug debugger capabilities and even several resources were hacked. I decided to look into it and it turned out that the technique doesn't work if the app is being run by a forking application server like uwsgi or gunicorn. So the questions are:
- Is there an opportunity to exploit Flask application with
debug=True
enabled even if it's being run by a forking application server (gunicorn, uwsgi)? I can't believe that all this hacked resources used built-in Flask's web server in production. - Did all that hacked sites run Flask app directly without using "standard" approach like nginx + gunicorn/uwsgi + Flask?