domains / families / security / flask-werkzeug-attack

flask-werkzeug-attack

separate

Exploit Flask/Werkzeug debugger exposure for traceback and SECRET leaks.

When to use

• Port scan reveals an unknown HTTP service on a non-standard port (8080, 8081, 8084, 5000, 8000, etc.)
• An API endpoint returns HTTP 500 with a Flask/Werkzeug error page
• A `?__debugger__=yes` parameter appears in URL resources (CSS, JS, PNG)
• The error page contains `var CONSOLE_MODE`, `var EVALEX`, or `SECRET=` in the HTML

When not to use

• Execute code when EVALEX=false
• Use when console mode is disabled

Skill page

Source