CVE-2024-10481

Summary

CVE-2024-10481 is a Cross-Site Request Forgery (CSRF) vulnerability affecting comfyanonymous/comfyui versions up to v0.2.2. This issue allows attackers to trick authenticated ComfyUI users into making unintended API requests. Malicious websites can be used to execute arbitrary requests on behalf of the user, potentially leading to actions like uploading unauthorized files via endpoints such as `/upload/image`. The absence of CSRF protections on API endpoints, including `/prompt` and `/history`, increases the risk of unauthorized actions. This vulnerability could be exploited in combination with other weaknesses, such as stored-XSS, to further compromise user sessions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.