SSRF in comfyanonymous/comfyui

The SSRF vulnerability in ComfyUI allows an attacker to craft malicious requests through the /internal/models/download and /view endpoints. By manipulating these requests, an attacker can force the ComfyUI server to make requests to arbitrary URLs, effectively using the server as a proxy. This can lead to the exposure of internal network resources, access to sensitive data stored on those resources, and potentially even the execution of arbitrary code on systems accessible from the ComfyUI server. The blast radius extends to any internal network segment accessible by the ComfyUI server, making it a significant security risk.

Organizations running ComfyUI, particularly those with internal network resources accessible from the server, are at risk. Environments utilizing ComfyUI for sensitive tasks or data processing are especially vulnerable. Shared hosting environments where ComfyUI is deployed alongside other applications should be carefully assessed for potential cross-tenant impact.

• python / server:

import requests
import urllib.parse

def check_ssrf(url):
    try:
        parsed_url = urllib.parse.urlparse(url)
        if parsed_url.scheme in ('http', 'https'):
            response = requests.get(url, timeout=5)
            print(f"URL: {url}, Status Code: {response.status_code}")
        else:
            print(f"Invalid URL scheme: {url}")
    except requests.exceptions.RequestException as e:
        print(f"Error accessing {url}: {e}")

# Example usage - check a potentially malicious URL
check_ssrf("http://localhost/internal/sensitive/data")

• generic web:

curl -I 'http://your-comfyui-server/internal/models/download?url=http://internal-resource/'

1. 2025-03-20Disclosure

   disclosure

1. Gereserveerd2024-12-20
2. Gepubliceerd2025-03-20
3. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-12882 is to upgrade ComfyUI to a patched version as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. These may include restricting network access to the ComfyUI server, implementing strict firewall rules to limit outbound connections, and carefully reviewing and validating all user inputs to prevent malicious URL manipulation. Monitoring network traffic for unusual outbound requests originating from the ComfyUI server can also help detect potential exploitation attempts. After upgrade, confirm by attempting a request to an internal resource and verifying that it is properly blocked or handled according to your security policies.