From d0320094b414c84afcdfafc7379afae4851d6059 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 02:32:36 +0000 Subject: [PATCH] Disable Flask debug mode on public interfaces to prevent Werkzeug interactive debugger exposure Co-authored-by: benpiper <4343814+benpiper@users.noreply.github.com> --- .Jules/sentinel.md | 4 ++++ web_app/app.py | 2 +- web_app/run.py | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 .Jules/sentinel.md diff --git a/.Jules/sentinel.md b/.Jules/sentinel.md new file mode 100644 index 0000000..60634ba --- /dev/null +++ b/.Jules/sentinel.md @@ -0,0 +1,4 @@ +## 2026-08-20 - Werkzeug Interactive Debugger Exposure +**Vulnerability:** Flask application bound to 0.0.0.0 with debug=True enabled, exposing the interactive debugger. +**Learning:** Running Flask with debug mode on a public interface allows unauthenticated remote code execution via the Werkzeug debugger. +**Prevention:** Ensure debug=False is explicitly set when binding to public IP addresses (0.0.0.0), or prefer using a production WSGI server instead of the built-in development server. diff --git a/web_app/app.py b/web_app/app.py index 8cd5aa5..688cc39 100644 --- a/web_app/app.py +++ b/web_app/app.py @@ -219,4 +219,4 @@ def download(job_id): if __name__ == '__main__': os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True) os.makedirs(app.config['OUTPUT_FOLDER'], exist_ok=True) - app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False) + app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False) diff --git a/web_app/run.py b/web_app/run.py index 6d017f1..6ddd4fd 100644 --- a/web_app/run.py +++ b/web_app/run.py @@ -22,4 +22,4 @@ print("Press CTRL+C to stop") print("=" * 60) - app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False) + app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)