Executive brief
Unfurl, a web application used for digital forensics and URL analysis, contains a flaw that forces it to run in 'debug mode' by default. This mode is intended only for developers and, when active, provides a window into the application's internal workings. An attacker can exploit this to view sensitive system information or potentially take full control of the server.
Technical details
A vulnerability exists in Unfurl's configuration parsing logic within `unfurl/app.py`. The application reads the `debug` setting from `unfurl.ini` as a string and passes it directly to Flask's `app.run(debug=...)`. Because Python evaluates any non-empty string (including 'False') as Truthy, debug mode remains active regardless of the configuration setting. This exposes the Werkzeug debugger to the network. If an attacker can trigger an application error or bypass the debugger PIN, they can achieve arbitrary code execution or disclose sensitive environment variables and stack traces.
Affected products
- RyanDFIR / Obsidian Forensics Unfurl (dfir-unfurl) through 2025.08
Timeline
- 2026-01-28: disclosed: Initial disclosure via GitHub Security Advisory
- 2026-04-08: advisory: NVD and VulnCheck publication