Flask app is run in debug mode¶
ID: py/flask-debug
Kind: problem
Security severity: 7.5
Severity: error
Precision: high
Tags:
- security
- external/cwe/cwe-215
- external/cwe/cwe-489
Query suites:
- python-code-scanning.qls
- python-security-extended.qls
- python-security-and-quality.qls
Click to see the query in the CodeQL repository
Running a Flask application with debug mode enabled may allow an attacker to gain access through the Werkzeug debugger.
Recommendation¶
Ensure that Flask applications that are run in a production environment have debugging disabled.
Example¶
Running the following code starts a Flask webserver that has debugging enabled. By visiting /crash, it is possible to gain access to the debugger, and run arbitrary code through the interactive debugger.
from flask import Flask
app = Flask(__name__)
@app.route('/crash')
def main():
raise Exception()
app.run(debug=True)
References¶
Flask Quickstart Documentation: Debug Mode.
Werkzeug Documentation: Debugging Applications.
Common Weakness Enumeration: CWE-215.
Common Weakness Enumeration: CWE-489.