Vulnerability · Published May 6, 2024 · Assigned by GitHub_M
CVE-2024-34069Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
High 7.5
In plain English
A high-severity cross-site request forgery in werkzeug from pallets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. Fixed versions are available - upgrade the affected package.
Official description
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-werkzeug | 2.2.2-3+deb12u1 | DEBIAN-CVE-2024-34069 |
| Debian:13 | python-werkzeug | 3.0.3-1 | DEBIAN-CVE-2024-34069 |
| Debian:14 | python-werkzeug | 3.0.3-1 | DEBIAN-CVE-2024-34069 |
| PyPI | werkzeug | 3.0.3 | GHSA-2g68-c3qc-8985 |
| PyPI | werkzeug | 3.0.3 | PYSEC-2026-2043 |
| Ubuntu:22.04:LTS | python-werkzeug | 2.0.2+dfsg1-1ubuntu0.22.04.2 | USN-6799-1 |
| Ubuntu:22.04:LTS | python-werkzeug | 2.0.2+dfsg1-1ubuntu0.22.04.2 | UBUNTU-CVE-2024-34069 |
| Ubuntu:24.04:LTS | python-werkzeug | 3.0.1-3ubuntu0.1 | UBUNTU-CVE-2024-34069 |
| Ubuntu:24.04:LTS | python-werkzeug | 3.0.1-3ubuntu0.1 | USN-6799-1 |
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985 x_refsource_CONFIRM
- https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692 x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/
- https://security.netapp.com/advisory/ntap-20240614-0004/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html