Server-Side Request Forgery in ComfyUI by ComfyAnonymous

CVE-2024-12882

What is CVE-2024-12882?

A non-blind Server-Side Request Forgery (SSRF) vulnerability exists in ComfyUI version v0.2.4, which can be exploited by attacking specific REST API endpoints. By leveraging the POST /internal/models/download and GET /view APIs, malicious actors can manipulate the victim server into making unauthorized requests, potentially exposing sensitive web resources and compromising security credentials.

References