CVE-2024-34069— Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
Public Exploits 1
Metasploit · 1 werkzeug_debug_rce.rb [exploit]
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-34069
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
Source: CVE Program / CVE List V5
Vulnerability Description
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
Pallets Werkzeug 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Pallets Werkzeug是一款WSGI Web应用程序库。 Pallets Werkzeug 3.0.3之前版本存在安全漏洞，该漏洞源于Werkzeug 调试器在与攻击者控制的域交互时容易受到远程执行的影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-34069
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Qwen3.6-35B-A3B · 6961 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2024-34069
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-34069 (1)
Vendor Advisories for CVE-2024-34069 (1)
Mailing List Discussions for CVE-2024-34069 (2)
IV. Related Vulnerabilities
Same product: werkzeug
- CVE-2026-27199
Werkzeug safe_join() allows Windows special device names - CVE-2026-21860
Werkzeug safe_join() allows Windows special device names wit - CVE-2025-66221
Werkzeug safe_join() allows Windows special device names - CVE-2024-49767
Werkzeug possible resource exhaustion when parsing file data - CVE-2024-49766
Werkzeug safe_join not safe on Windows
Same vendor: pallets
- CVE-2026-27205
Flask session does not add `Vary: Cookie` header when access - CVE-2026-27199
Werkzeug safe_join() allows Windows special device names - CVE-2026-21860
Werkzeug safe_join() allows Windows special device names wit - CVE-2025-66221
Werkzeug safe_join() allows Windows special device names - CVE-2025-47278
Flask uses fallback key instead of current signing key
Same weakness: CWE-352
- CVE-2026-17608
WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbit - CVE-2026-18165
@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth - CVE-2026-67366
Joomla Extension - icagenda.com - CSRF on frontend registrat - CVE-2026-73847
Emlog: Missing CSRF protection in AI Assistant execute_tool - CVE-2026-57469
Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
V. Comments for CVE-2024-34069
No comments yet