From 4b8ffdc817a2428b8d60a33aa273387deec6c5e4 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 02:17:05 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[CRITICAL]?= =?UTF-8?q?=20Fix=20Werkzeug=20interactive=20debugger=20exposure?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Disabled Flask development server debug mode on public interfaces (0.0.0.0) - Prevented unauthenticated Remote Code Execution (RCE) via Werkzeug interactive debugger - Updated application entry points in web_app/app.py and web_app/run.py Co-authored-by: benpiper <4343814+benpiper@users.noreply.github.com> --- .Jules/sentinel.md | 5 +++++ web_app/app.py | 4 +++- web_app/run.py | 4 +++- 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .Jules/sentinel.md diff --git a/.Jules/sentinel.md b/.Jules/sentinel.md new file mode 100644 index 0000000..349b314 --- /dev/null +++ b/.Jules/sentinel.md @@ -0,0 +1,5 @@ + +## 2026-08-25 - Werkzeug Interactive Debugger Exposure +**Vulnerability:** Flask development server was configured with `debug=True` while bound to a public interface (`0.0.0.0`), exposing the Werkzeug interactive debugger which allows unauthenticated Remote Code Execution (RCE). +**Learning:** Development configurations should never be hardcoded and exposed on public interfaces, especially in network-facing scripts like `web_app/run.py`. +**Prevention:** Explicitly set `debug=False` in production application entry points, or use environment variables to control debug mode instead of hardcoding `True`. diff --git a/web_app/app.py b/web_app/app.py index 8cd5aa5..2f95e5f 100644 --- a/web_app/app.py +++ b/web_app/app.py @@ -219,4 +219,6 @@ def download(job_id): if __name__ == '__main__': os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True) os.makedirs(app.config['OUTPUT_FOLDER'], exist_ok=True) - app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False) + # 🛡️ Sentinel: Disable debug mode on public interfaces (0.0.0.0) + # to prevent Werkzeug interactive debugger RCE vulnerability. + app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False) diff --git a/web_app/run.py b/web_app/run.py index 6d017f1..7f391f9 100644 --- a/web_app/run.py +++ b/web_app/run.py @@ -22,4 +22,6 @@ print("Press CTRL+C to stop") print("=" * 60) - app.run(debug=True, host='0.0.0.0', port=5000, threaded=True, use_reloader=False) + # 🛡️ Sentinel: Disable debug mode on public interfaces (0.0.0.0) + # to prevent Werkzeug interactive debugger RCE vulnerability. + app.run(debug=False, host='0.0.0.0', port=5000, threaded=True, use_reloader=False)