CVE-2026-40035

### Summary The Unfurl web app enables Flask debug mode even when configuration sets `debug = False`. The config value is read as a string and passed directly to `app.run(debug=...)`, so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. ### Details - `unfurl/app.py:web_app()` reads `debug` via `config['UNFURL_APP'].get('debug')`, which returns a string. - `UnfurlApp.__init__` passes that string directly to `app.run(debug=unfurl_debug, ...)`. - If `unfurl.ini` omits `debug`, the default argument is the string `"True"`. - As a result, debug mode is effectively always on and cannot be reliably disabled via config. ### PoC 1. Create a local `unfurl.ini` with `debug = False` under `[UNFURL_APP]`. 2. Run the server using `unfurl_app` (or `python -c 'from unfurl.app import web_app; web_app()'`). 3. Observe server logs showing `Debug mode: on` / `Debugger is active!`. 4. The included PoC script `security_poc/poc_debug_mode.py --spawn` automates this check. ### PoC Script (inline) ```python #!/usr/bin/env python3 """ Unfurl Debug Mode PoC (Corrected) ================================ This PoC demonstrates that Unfurl's Flask debug mode is effectively **always enabled by default** due to string parsing of the `debug` config value. Even `debug = False` in `unfurl.ini` evaluates truthy when passed to `app.run(debug=...)`. Two modes: 1) --spawn (default): launch a local Unfurl server with debug=False in a temp config and inspect logs for "Debug mode: on". 2) --target: attempt a remote indicator check (best-effort; may be silent if no exception is triggered). """ import argparse import os import subprocess import sys import tempfile import textwrap import time def run_spawn_check() -> None: repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..')) ini_contents = textwrap.dedent(""" [UNFURL_APP] host = 127.0.0.1 port = 5055 debug = False remote_lookups = false [API_KEYS] bitly = macaddress_io = """).strip() + "\n" with tempfile.TemporaryDirectory() as tmp: ini_path = os.path.join(tmp, 'unfurl.ini') with open(ini_path, 'w') as f: f.write(ini_contents) env = os.environ.copy() env['PYTHONPATH'] = repo_root cmd = [sys.executable, '-c', 'from unfurl.app import web_app; web_app()'] proc = subprocess.Popen( cmd, cwd=tmp, env=env, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True ) # Allow server to start and emit logs time.sleep(2) proc.terminate() try: out, err = proc.communicate(timeout=2) except subprocess.TimeoutExpired: proc.kill() out, err = proc.communicate() output = (out or "") + (err or "") print("\n[+] Debug mode spawn check") print(" Config: debug = False") if "Debug mode: on" in output or "Debugger is active" in output: print(" ✅ Debug mode is ON despite debug=False (vulnerable)") else: print(" ⚠️ Debug mode not detected in logs (check output below)") if output.strip(): print("\n--- server output (truncated) ---") print("\n".join(output.splitlines()[:15])) print("--- end ---") def run_remote_probe(target: str) -> None: import requests print("\n[+] Remote debug indicator probe (best-effort)") print(f" Target: {target}") # This app does not easily throw exceptions from user input, so # absence of indicators does NOT prove debug is off. probe_urls = [ f"{target.rstrip('/')}/__nonexistent__", ] detected = False for url in probe_urls: try: resp = requests.get(url, timeout=10) if "Werkzeug Debugger" in resp.text or "Traceback" in resp.text: detected = True print(" ✅ Debug indicators found") break except Exception as e: print(f" ⚠️ Probe failed: {e}") if not detected: print(" ⚠️ No debug indicators found (this is not definitive)") def main(): parser = argparse.ArgumentParser(description='Unfurl debug mode PoC (corrected)') parser.add_argument('--spawn', action='store_true', help='Run local spawn check (default)') parser.add_argument('--target', help='Target Unfurl URL for remote probe') args = parser.parse_args() if args.target: run_remote_probe(args.target) else: run_spawn_check() if __name__ == '__main__': main() ``` ### Impact If the service is exposed beyond localhost (bound to 0.0.0.0 or reverse-proxied), an attacker can access the Werkzeug debugger. This can disclose sensitive information and may allow remote code execution if a debugger PIN is obtained. At minimum, stack traces and environment details are exposed on errors.

Unfurl hasta 2025.08 contiene una vulnerabilidad de validación de entrada incorrecta en el análisis de configuración que habilita el modo de depuración de Flask por defecto. El valor de configuración de depuración se lee como una cadena de texto y se pasa directamente a app.run(), lo que provoca que cualquier cadena de texto no vacía se evalúe como verdadera, permitiendo a los atacantes acceder al depurador de Werkzeug y divulgar información sensible o lograr ejecución remota de código.