Executive brief
Werkzeug is a widely-used Python web framework toolkit that includes a development debugger for testing applications. The debugger can be exploited to execute arbitrary code on a developer's machine if they visit a malicious domain controlled by an attacker and enter the debugger PIN. While this requires social engineering and the attacker to guess a triggering URL, successful exploitation grants full code execution on the developer's system.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) flaw in the Werkzeug debugger that allows an attacker to gain unauthorized access to the debugger interface. An attacker can craft a malicious domain and subdomain under their control, and if they trick a developer into visiting it, they can bypass the PIN protection and access the debugger even when it is running only on localhost. This requires the attacker to guess a URL that triggers the debugger in the target application, but if successful, provides unrestricted code execution. The vulnerability was patched in version 3.0.3; all earlier versions (0.x through 3.0.2) are affected.
Affected products
- Pallets Werkzeug <3.0.3
Timeline
- 2024-05-06: disclosed
- 2024-05-06: patched: Version 3.0.3 released with fix