Web API Remote Code Execution (RCE) example

app.py

from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/hack-me', methods=['POST'])
def evaluate_expression():
    try:
        user_input = request.json.get('expression')
        ## UNSAFE
        result = eval(user_input) 
        
        return jsonify({'result': result})
    except Exception as e:
        return jsonify({'error': str(e)}), 400

if __name__ == '__main__':
    app.run(debug=True)