CVE-2024-34069
📋 TL;DR
This vulnerability in Werkzeug's debugger allows attackers to execute arbitrary code on a developer's machine if they can trick the developer into interacting with a controlled domain/subdomain and entering the debugger PIN. It affects developers using Werkzeug's debugger feature in vulnerable versions. Successful exploitation requires the attacker to also guess a URL in the developer's application that triggers the debugger.
💻 Affected Systems
- Werkzeug
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Werkzeug by Palletsprojects
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on developer's machine, potentially leading to complete system compromise, data theft, or lateral movement within the development environment.
Likely Case
Limited code execution in the context of the debugger process, potentially allowing file access, credential theft, or further privilege escalation.
If Mitigated
No impact if debugger is disabled or proper network segmentation prevents external access to development environments.
🎯 Exploit Status
Exploitation requires social engineering (getting developer to interact with malicious domain) and guessing application URLs that trigger debugger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.3
Vendor Advisory: https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985
Restart Required: Yes
Instructions:
1. Update Werkzeug: pip install --upgrade werkzeug==3.0.3
2. Restart your Python application
3. Verify the update with: pip show werkzeug
🔧 Temporary Workarounds
Disable Debugger
allDisable the Werkzeug debugger in all environments, especially production.
Set debug=False in Flask app configuration or ensure debugger is not enabled
Network Isolation
allEnsure debugger is only accessible on localhost with proper firewall rules.
Configure firewall to block external access to debugger port (typically 5000)
🧯 If You Can't Patch
- Disable Werkzeug debugger entirely in all environments
- Implement strict network segmentation to isolate development environments from production and external networks
🔍 How to Verify
Check if Vulnerable:
Check Werkzeug version: pip show werkzeug | grep Version. If version is below 3.0.3 and debugger is enabled, system is vulnerable.Check Version:
pip show werkzeug | grep VersionVerify Fix Applied:
Verify Werkzeug version is 3.0.3 or higher: pip show werkzeug | grep Version📡 Detection & Monitoring
Log Indicators:
- Unexpected debugger activation from unusual IPs
- Multiple failed PIN attempts in debugger logs
- Debugger access from non-localhost addresses
Network Indicators:
- External connections to debugger port (typically 5000)
- DNS requests to suspicious domains from development systems
SIEM Query:
source="werkzeug" AND ("Debugger PIN" OR "debugger") AND src_ip!=127.0.0.1🔗 References
- https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692
- https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ/
- https://security.netapp.com/advisory/ntap-20240614-0004/
- https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692
- https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985
- https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ/
- https://security.netapp.com/advisory/ntap-20240614-0004/
