CVE-2024-21574

CVSS V2 None CVSS V3 None

Description

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or URL, resulting in remote code execution (RCE) on the server.

Overview

CVE ID
CVE-2024-21574

Assigner
snyk

Vulnerability Status
PUBLISHED

Published Version
2024-12-12T08:15:11.464Z

Last Modified Date
2024-12-12T14:37:18.494Z

Weakness Enumerations

CWE	URL
CWE-94	http://cwe.mitre.org/data/definitions/94.html

References

Reference URL	Reference Tags
https://github.com/ltdrdata/ComfyUI-Manager/commit/ffc095a3e5acc1c404773a0510e6d055a6a72b0e
https://github.com/ltdrdata/ComfyUI-Manager/blob/ffc095a3e5acc1c404773a0510e6d055a6a72b0e/glob/manager_server.py#L798

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21574
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21574

History

Created	Old Value	New Value	Data Type	Notes
2024-12-13 13:36:47				Added to TrackCVE