Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-console-bypass

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin.

2 days ago - A message regarding the “console locked” scenario is encountered when attempting to access Werkzeug’s debug interface, indicating a requirement for a PIN to unlock the console. The suggestion is made to exploit the console PIN by analyzing the PIN generation algorithm in Werkzeug’s debug initialization file (__init__.py).

April 10, 2023 - Step by step example of cracking a Flask/Werkzeug PIN after finding an LFI exploit inside a web application

This is a security helper to make ... to be exploited if you forget to disable it when deploying to production. The PIN based authentication is enabled by default. The first time a console is opened, a dialog will prompt for a PIN that is printed to the command line.

September 30, 2021 - Locate vulnerable Werkzeug debug console at path vulnerable-site.com/console, but is locked by secret PIN number.

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin.

January 10, 2020 - You can find the PIN printed out on the standard output of your shell that runs the server · Locate vulernable Werkzeug debug console at path vulnerable-site.com/console, but is locked by secret PIN number.

These exploits were developed after reviewing Werkzeug source code repo to better understand how the code is generated to then reverse it. The following is the function that generates the pin in Werkzeug from __init__.py.

March 11, 2023 - Learn how to crack the Werkzeug Debugger pin and gain access to the console in Python-based Flask web applications with this educational blog post.

November 10, 2024 - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell :)GitHub · https://www.daehee.com/werkzeug-console-pin-exploit/

By exploiting the path traversal vulnerability and gathering system information, we successfully generate the debug pin required to access the Werkzeug debugger console remotely.

October 8, 2022 - We can get foothold by generating the console PIN using the exploit from here · https://github.com/wdahlenburg/werkzeug-debug-console-bypass ·

August 4, 2023 - Agile involved using Local File Read (LFR) to read the source files with debug mode enabled, allowing to access werkzeug console by reading files responsible for generating PIN, having access to the console, getting a shell as www-data and escalating to corum user by accessing the database to retrieve the password, further escalating to edwards by port forwarding Selenium port to inspect a testing page of the application, getting the password and finally escalating to root by abusing python virtual environment activation script through sudoedit (CVE 2023–22809).

Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

* Debugger PIN: 234-662-675 ``` ... and there was this function ```python def get_pin_and_cookie_name(app): """Given an application object this returns a semi-stable 9 digit pin code and a random key....

May 6, 2024 - This is a potential security issue, you are being redirected to https://nvd.nist.gov · Official websites use .gov A .gov website belongs to an official government organization in the United States