Vulnerabilities/

Werkzeug Interactive Debugging is Active

Impact: Medium

Description

Werkzeug is a comprehensive WSGI web application library for the Python language. Werkzeug provides a WSGI middleware that renders nice tracebacks, optionally with an interactive debug console to execute code in any frame. This console functionality can be abused by attackers to run commands on the server.

Recommendation

Do not use the DebuggedApplication on the production servers. And, make sure to pass False as the use_debugger value in the run_simple() function call. If you’re using Flask, set the FLASK_ENV to production in the environment variables.

References

Last updated on December 12, 2021

Use SmartScanner Free version to test for this issue

Download