CVE-2024-34069highCWE-352

CVE-2024-34069: high-severity vulnerability in pallets werkzeug

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Published · Updated

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.5epss 3.4%
from disclosure to weapon0 days
Published on NVDMay 6
metasploitJun 28
exploitation probability
3.4%top 12% of all CVEs
observed exploitation
nono source reports it
In short

Werkzeug's debugger can be exploited by attackers to run malicious code on a developer's computer if the developer visits an attacker-controlled website and enters the debugger PIN. This is dangerous because it gives attackers direct access to run commands on the developer's machine.

Technical detail

A CSRF protection bypass (CWE-352) combined with improper pathname handling in Werkzeug's debugger allows remote code execution. The attack requires social engineering to trick a developer into visiting an attacker-controlled domain, entering the debugger PIN, and guessing a URL that triggers the debugger; successful exploitation grants arbitrary code execution even when the debugger is bound to localhost.

Summary generated and translated by AI from the official description.
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
pallets · werkzeug
Related CVEs — pallets werkzeug

In the same product, most dangerous first.

CVE-2023-25577HIGHWerkzeug may allow high resource usage when parsing multipart form data with many fieldsEPSS 1.4%CVE-2024-49767MEDIUMWerkzeug possible resource exhaustion when parsing file data in formsEPSS 1.1%CVE-2023-46136HIGHWerkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningEPSS 1.1%CVE-2024-49766MEDIUMWerkzeug safe_join not safe on WindowsEPSS 0.8%CVE-2026-27199MEDIUMWerkzeug safe_join() allows Windows special device namesEPSS 0.5%CVE-2025-66221MEDIUMWerkzeug safe_join() allows Windows special device namesEPSS 0.5%
References
https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985https://lists.debian.org/debian-lts-announce/2025/02/msg00026.htmlhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ/https://security.netapp.com/advisory/ntap-20240614-0004/