You can turn off the console debugger though if it's making you uneasy by doing this:
app.run('localhost', debug=True, use_evalex=False)
I'm not doubting you...I'd simply like to understand. Thanks.
That's pretty much the exact designed intent of the software. Read the Repl code, specifically, Repl#call at line 59 or so.
https://github.com/codegram/rack-webconsole/blob/master/lib/...
You'll note the code has recently been enhanced with check_legitimate, which was designed to patch the issue I raised on this thread (and via email). I am going to very carefully avoid commenting about whether check_legitimate actually works as designed. My main worry is that pronouncing it done well would make me professionally responsible when it gets cracked, and committing to endless rounds of "Actually, that won't really work" throws good hours after bad in pursuit of securing a bad idea which is architecturally insecurable.
Do not allow your web application to execute arbitrary code. It will not end well.
The most voted comment is from patio11 about it being a very bad idea. A lot of discussion and hand-waving happened before finally CRSF was even mentioned. Once the author implemented a CSRF fix, the conversation seemed to quiet down. So is this kind of web-based access on the road to being safe and usable now? Many popular VPS hosts offer out-of-band access through web-based consoles such as Anyterm and Ajaxterm. Are those acceptable simply because they've taken care of the CSRF, XSS common issues? They allow arbitrary code on the remote boxes so how are they different from a security concern? I have no idea so I just threw out SSL even though it probably makes no bit of difference. I simply don't have the background or experience to know. Is it time to be concerned about how proficient the hosts are in securing their hypervisors and bridged networking for guests? If they do pose a concern, then why is there not more brouhaha about it to get some attention on the matter? Linode and Slicehost have a lot of customers...
To just say it is a bad idea and move on and not mention other implementations seems to leave a bad taste. Someone also asked about Werkzeug(of the Python demesne) as well...
There is some buzz about doing cloud to cloud attacks but I haven't heard anything that's been realized yet. I have also heard that there are issues with data staying resident on local disks on EC2 after machine termination, but I don't know if that's the case.
Turn on Rails.
Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter.
Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings.
Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you were looking at. Any element would do. Say, you come to a blog where I control an image embed for my avatar, and I embed <img src="http://localhost:3000/a-malicious-string />. Firefox is going to make the HTTP request I desire without you having to do anything suspicious and without me having to ever talk to localhost:3000 directly.
After I have a malicious string in your web server, this application lets me execute arbitrary code as your web server. Things get very, very interesting then, in the "may you live in interesting times" sense of interesting. For example, one interesting thing I could do is read your SSH private key, which you use to connect from development to staging or production. Another thing I could do is read your database credentials from database.yml, and maybe even just open up extra ActiveRecord connections directly to those databases and start executing arbitrary SQL. Still another thing I could do is install a keylogger or rootkit on your local machine and wait to get whatever credential I need to totally compromise your company. There are many, many options.
Do not install this anywhere.