Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-10481— Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui

Quick assessment

Affected
comfyanonymous comfyanonymous/comfyui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ComfyUI是comfyanonymous个人开发者的一个最强大和模块化的扩散模型 GUI 和后端。 ComfyUI v0.2.2及之前版本存在跨站请求伪造漏洞，该漏洞源于CSRF保护不足，可能导致未经授权的API请求。

AI Predicted 7.1 Difficulty: Easy EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-10481

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui
Source: CVE Program / CVE List V5
Vulnerability Description
A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary files via the `/upload/image` endpoint. The lack of CSRF protections on API endpoints like `/upload/image`, `/prompt`, and `/history` leaves users vulnerable to unauthorized actions, which could be combined with other vulnerabilities such as stored-XSS to further compromise user sessions.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
ComfyUI 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ComfyUI是comfyanonymous个人开发者的一个最强大和模块化的扩散模型 GUI 和后端。 ComfyUI v0.2.2及之前版本存在跨站请求伪造漏洞，该漏洞源于CSRF保护不足，可能导致未经授权的API请求。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
comfyanonymous comfyanonymous/comfyui unspecified ~ latest -

II. Public POCs for CVE-2024-10481

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-10481

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-10481 (1)

IV. Related Vulnerabilities

Same product: comfyanonymous/comfyui
Same vendor: comfyanonymous
Same weakness: CWE-352

V. Comments for CVE-2024-10481

No comments yet

Leave a comment