Listen to this Post
The vulnerability exploits how the Python ConfigParser module interprets HTTP query parameters. When ComfyUI-Manager’s configuration endpoint processes user input, it fails to sanitize carriage return (CR, \r) and line feed (LF, \n) characters. An attacker can craft a request with parameters containing these CRLF sequences. When the `write_config()` function writes these values to the `config.ini` file, the injected characters are interpreted as newlines, allowing the attacker to break out of the intended key-value pair and insert entirely new configuration directives. This grants the ability to alter security-critical settings, modify application paths, or change behaviors by corrupting the configuration file structure directly through a remote HTTP request.
Platform: ComfyUI-Manager
Version: Prior to 3.39.2
Vulnerability: CRLF Injection Attack
Severity: High
date: Not Disclosed
Prediction: Patched; Immediate Update
What Undercode Say:
curl -G --data-urlencode "param=injected_value\r\n[bash]" http://target:8188/config
import configparser
config = configparser.ConfigParser()
config.read('config.ini')
Check for malformed sections
print(config.sections())
Exploit:
GET /config?setting=value%0d%0a[bash]%0d%0akey=bad_value HTTP/1.1
Protection from this CVE
- Upgrade to versions 3.39.2 or 4.0.5.
- Implement strict input validation for all configuration endpoints.
- Run service on localhost without
--listen.
Impact:
Security setting tampering.
Arbitrary configuration modification.
Remote code execution potential.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
