Description
ComfyUI 是 一个基于节点流程的 Stable Diffusion 操作界面,可以通过流程,实现了更加精准的工作流定制和完善的可复现性。2024年互联网上披露其存在文件读取漏洞，攻击者可在无需登陆的情况下读取遍历系统上的文件，造成敏感信息泄漏。
参考链接：https://github.com/comfyanonymous/ComfyUI/pull/2902
ComfyUI follow_symlinks 文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/omfyUI/omfyUI%20follow_symlinks%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://www.secevery.com/toBugInfo?id=1864624481916207106
https://cn-sec.com/archives/2601614.html
https://zone.ci/aliyun/ali_nonvd/364906.html
https://avd.aliyun.com/high-risk/list?page=8
https://www.secrss.com/articles/76089