Skip to content

Commit f209316

Browse files
authored
Update werkzeug_debug_rce.rb
Use percent strings for module description
1 parent 5228acb commit f209316

File tree

1 file changed

+12
-13
lines changed

1 file changed

+12
-13
lines changed

modules/exploits/multi/http/werkzeug_debug_rce.rb

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,19 +19,18 @@ def initialize(info = {})
1919
update_info(
2020
info,
2121
'Name' => 'Pallete Projects Werkzeug Debugger Remote Code Execution',
22-
'Description' => 'This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug ' \
23-
'is included with Flask, but not enabled by default. It is also included in other ' \
24-
'projects, for example the RunServerPlus extension for Django. It may also be used ' \
25-
"alone.\n\n" \
26-
'The documentation states the following: "The debugger must never be used on production ' \
27-
'machines. We cannot stress this enough. Do not enable the debugger in production." Of ' \
28-
"course this doesn't prevent developers from mistakenly enabling it in production!\n\n" \
29-
"Tested against the following Werkzeug versions:\n" \
30-
"- 3.0.3 on Debian 12, Windows 11 and macOS 14.6\n" \
31-
"- 1.1.4 on Debian 12\n" \
32-
"- 1.0.1 on Debian 12\n" \
33-
"- 0.11.5 on Debian 12\n" \
34-
'- 0.10 on Debian 12',
22+
'Description' => %q{
23+
This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django. It may also be used alone.
24+
25+
The documentation states the following: "The debugger must never be used on production machines. We cannot stress this enough. Do not enable the debugger in production." Of course this doesn't prevent developers from mistakenly enabling it in production!
26+
27+
Tested against the following Werkzeug versions:
28+
- 3.0.3 on Debian 12, Windows 11 and macOS 14.6
29+
- 1.1.4 on Debian 12
30+
- 1.0.1 on Debian 12
31+
- 0.11.5 on Debian 12
32+
- 0.10 on Debian 12
33+
},
3534
'Author' => [
3635
'h00die <mike[at]shorebreaksecurity.com>',
3736
'Graeme Robinson <metasploit[at]grobinson.me>/@GraSec'

0 commit comments

Comments
 (0)