CVE-2025-66221
📋 TL;DR
This vulnerability in Werkzeug's safe_join function allows attackers to cause denial of service by requesting paths ending with Windows device names (like CON, AUX). When exploited on Windows systems, it causes the file reading operation to hang indefinitely. Only applications running on Windows using Werkzeug's send_from_directory function are affected.
💻 Affected Systems
- Werkzeug
📦 What is this software?
Werkzeug by Palletsprojects
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for the affected endpoint, potentially causing application unavailability and resource exhaustion.
Likely Case
Temporary service disruption for specific file-serving endpoints, requiring manual intervention to restart affected processes.
If Mitigated
Minimal impact with proper monitoring and process management that can detect and restart hung processes.
🎯 Exploit Status
Exploitation requires crafting HTTP requests with specific path parameters ending in Windows device names.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.4
Vendor Advisory: https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2
Restart Required: Yes
Instructions:
1. Update Werkzeug to version 3.1.4 or later using pip: pip install --upgrade werkzeug>=3.1.4
2. Restart your application server
3. Verify the update was successful
🔧 Temporary Workarounds
Input Validation Filter
windowsAdd middleware to filter out requests containing Windows device names in paths
Implement request filtering before send_from_directory calls
Platform Migration
allDeploy application on Linux/macOS instead of Windows
🧯 If You Can't Patch
- Implement WAF rules to block requests containing Windows device names in URL paths
- Add monitoring and alerting for hung processes with automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check if running Werkzeug <3.1.4 on Windows and using send_from_directory functionCheck Version:
python -c "import werkzeug; print(werkzeug.__version__)"Verify Fix Applied:
Verify Werkzeug version is 3.1.4 or higher and test file serving with previously problematic paths📡 Detection & Monitoring
Log Indicators:
- Repeated requests to paths ending with CON, AUX, PRN, NUL, COM1-COM9, LPT1-LPT9
- Unusually long file serving response times
Network Indicators:
- HTTP requests with Windows device names in URL paths
- Hanging HTTP connections to file serving endpoints
SIEM Query:
source="web_logs" AND (url="*CON" OR url="*AUX" OR url="*PRN" OR url="*NUL" OR url="*COM[1-9]" OR url="*LPT[1-9]")