GHSA-vg9h-jx4v-cwx2: Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with pip-audit (or: pip show <package>).
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.run(debug=...), so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default.

Details - unfurl/app.py:webapp() reads debug via config['UNFURLAPP'].get('debug'), which returns a string. - UnfurlApp.init passes that string directly to app.run(debug=unfurldebug, ...). - If unfurl.ini omits debug, the default argument is the string "True". - As a result, debug mode is effectively always on and cannot be reliably disabled via config.

PoC 1. Create a local unfurl.ini with debug = False under [UNFURLAPP]. 2. Run the server using unfurlapp (or python -c 'from unfurl.app import webapp; webapp()'). 3. Observe server logs showing Debug mode: on / Debugger is active!. 4. The included PoC script securitypoc/pocdebugmode.py --spawn automates this check.

PoC Script (inline)

Impact If the service is exposed beyond localhost (bound to 0.0.0.0 or reverse-proxied), an attacker can access the Werkzeug debugger. This can disclose sensitive information and may allow remote code execution if a debugger PIN is obtained. At minimum, stack traces and environment details are exposed on errors.

CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Sources and references

1. GitHub Advisory GHSA-vg9h-jx4v-cwx2 github.com
2. github.com github.com
3. github.com github.com

Critical PyPI advisories · Today’s Security Digest