Werkzeug Debugger Vulnerability Allows Attacker to Execute Code on Developer's Machine
CVE-2024-34069

7.5HIGH

Key Information:

Vendor

Pallets

Status
Werkzeug
Vendor
CVE Published:
6 May 2024

What is CVE-2024-34069?

The Werkzeug library, a popular WSGI web application toolkit, possesses a vulnerability that could allow an attacker to remotely execute code on a developer's machine. This could occur when a developer inadvertently interacts with an attacker-controlled domain and inputs the debugger PIN. Successful exploitation requires the attacker to guess a specific URL in the developer’s application that triggers the debugger. As a result, even a debugger running solely on localhost becomes accessible, posing severe risks to the integrity of the developer's environment. This issue has been addressed in version 3.0.3 of Werkzeug.

Affected Version(s)

werkzeug < 3.0.3

References

https://github.com/pallets/werkzeug/security/advisories/G...
x_refsource_CONFIRM
https://github.com/pallets/werkzeug/commit/3386395b24c737...
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-34069 : Werkzeug Debugger Vulnerability Allows Attacker to Execute Code on Developer's Machine