CVE-2024-12882

Name of the Vulnerable Software and Affected Versions comfyanonymous/comfyui version v0.2.4

Description The issue is related to a non-blind Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can be exploited by combining the REST APIs POST /internal/models/download and GET /view, allowing attackers to abuse the victim server's credentials to access unauthorized web resources.

Recommendations For comfyanonymous/comfyui version v0.2.4, as a temporary workaround, consider restricting access to the POST /internal/models/download and GET /view API endpoints until a patch is available. Avoid using these endpoints in combination to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.