Listen to this Post
How the Vulnerability Works
The vulnerability exists in how the Unfurl web application processes its debug configuration. The `web_app()` function in `unfurl/app.py` reads the `debug` setting from the `unfurl.ini` configuration file via config['UNFURL_APP'].get('debug'). This value is always retrieved as a string. This string is then passed directly, without type conversion, to the Flask application’s `app.run(debug=unfurl_debug)` method. In Python, a non-empty string (like "False") evaluates to `True` in a boolean context. Consequently, even if the administrator sets `debug = False` in the config file, the string `”False”` is truthy, forcing the Werkzeug debugger to be permanently activated. If the setting is omitted, the default is the string "True", guaranteeing debug mode is on.
DailyCVE
Platform: Unfurl
Version: All
Vulnerability: Debug Mode Activation
Severity: Critical
Date: 2024-04-01
Prediction: 2024-04-15
What Undercode Say:
Analytics
grep -r "app.run(debug=" unfurl/
cat unfurl.ini | grep -A2 "[UNFURL_APP]"
python -c "print(bool('False'))" Returns True
PoC core logic
ini_config = {"debug": "False"}
unfurl_debug = ini_config.get('debug', 'True') Returns string 'False'
app.run(debug=unfurl_debug) Evaluates as True
How Exploit:
- Attacker accesses the Unfurl instance exposed on a network.
- Attacker triggers an error (e.g., requests a non-existent page).
- The Werkzeug interactive debugger interface loads in the response.
- Attacker views stack traces, environment variables, and source code.
- If the debugger PIN is obtained or disabled, attacker executes arbitrary code.
Protection from this CVE
- Manually patch `unfurl/app.py` to convert the debug string to a boolean.
- Ensure the application is not exposed to untrusted networks.
3. Apply the official vendor patch when released.
- Use a proper WSGI server (e.g., Gunicorn) for production deployment.
Impact:
Information Disclosure
Remote Code Execution
Sensitive Data Exposure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
