Insecure Functionality Exposed in Python
Flask
Flask (via Werkzeug) provides debugging functionalities via the browser when an exception is raised. Even though a PIN can be provided so that only developers are able to access this feature, it should never be enabled in a production environment. When debug mode is enabled, the full stack traces are displayed. An interactive Python shell is also provided, by default this is protected by a PIN. If the PIN is disabled or easily guessable, the shell can be used to compromise the system.
Vulnerable Example
The debugger mode can be enabled with the FLASK_DEBUG=1
environment variable, while the PIN can be disabled with WERKZEUG_DEBUG_PIN=off
or set to a predictable value.
Prevention
Never ship debugging features in production environments.
References
OWASP Top 10 - Security Misconfiguration MITRE - CWE 749 Exposed Dangerous Method or Function