The Debug Flag That Opened the Door: A Journey From Django Debug Mode to Critical RCE

About Me

I am an independent security researcher who enjoys learning how applications work and exploring security from different perspectives. This write-up is a small attempt to share my learning journey with the community.

It Started With a Debug Page

During an assessment of a web application, I noticed something unusual. The application was built with Django, and the first thing that caught my attention was that debug mode appeared to be enabled in production.

For many developers, a debug page is simply an error message. For a security researcher, it can become a source of intelligence.

The exposed information revealed details about the application's environment, including filesystem paths and directory structures.

One particular detail caught my eye:

BASE_DIR : /home/user/app_dir

BASE_DIR : /home/user/app_dir

Connecting the Dots

The directory structure looked familiar.

The pattern reminded me of applications deployed on shared hosting environments, especially setups commonly seen with cPanel Hosting

Instead of treating the leaked path as just a piece of information, I used it as a clue about the underlying infrastructure.

A simple assumption formed:

"If this application follows common hosting patterns, maybe the hosting environment exposes additional services."

That led me to check whether the domain was associated with a cPanel hosting . So I checked the domain

https://site.com:2083

https://site.com:2083

The assumption was correct.

The environment appeared to be using a hosting panel commonly found in web hosting setups.

Now the question changed:

"How does this application handle files?"

Looking Beyond the Framework

A common belief among developers is:

"Django applications don't execute uploaded files, so file uploads are safe."

That assumption is often true inside the Django application itself. But applications rarely exist in isolation. They run on servers. They interact with web servers. They share environments with other technologies. So instead of only asking:

"Can I upload a file? Where does this file end up, and what does the surrounding environment do with it?"

The Upload Discovery

While testing the application, I identified multiple file upload features.

One profile upload functionality allowed files with weak validation and stored them in a publicly accessible asset location.

The interesting part was not the upload itself . it was understanding where the file landed and how the underlying hosting environment handled it.

The application was built with Django, but the server environment supported additional technologies like php.

Final Thoughts

The biggest lesson from this research was:

"Don't only test what the application does. Test what the application assumes."

Framework knowledge is important, but understanding deployment environments, infrastructure, and trust boundaries can reveal issues that automated scanners will never find.

Sometimes the best bugs are not hidden behind complicated payloads. Sometimes they are hidden behind a simple question:

"What happens if this assumption is wrong?"