Flask/Werkzeug Debugger Exploitation

Flask applications with debug=True enable the Werkzeug debugger, which exposes stack traces and (optionally) an interactive Python console. The debugger runs at the same port as the Flask app and activates on any unhandled exception (HTTP 500).

When to Use

• Port scan reveals an unknown HTTP service on a non-standard port (8080, 8081, 8084, 5000, 8000, etc.)
• An API endpoint returns HTTP 500 with a Flask/Werkzeug error page
• A ?__debugger__=yes parameter appears in URL resources (CSS, JS, PNG)
• The error page contains var CONSOLE_MODE, var EVALEX, or SECRET= in the HTML

Prerequisites

• terminal with curl
• A Flask API server with debug=True in production (misconfiguration)
• An endpoint that triggers HTTP 500 (unhandled exception)

Quick Detection