CVE-2024-21576: ComfyUI-Bmad-Nodes RCE Vulnerability

CVE-2024-21576 Overview

CVE-2024-21576 is a critical Code Injection vulnerability affecting ComfyUI-Bmad-Nodes, a custom node extension for the ComfyUI image generation platform. The vulnerability stems from a validation bypass in multiple custom nodes including BuildColorRangeHSVAdvanced, FilterContour, and FindContour. In the entrypoint function to each node, there's a call to eval() which can be triggered by generating a workflow that injects a crafted string into the node. Successful exploitation can result in executing arbitrary code on the server with the privileges of the ComfyUI process.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on servers running ComfyUI with the Bmad-Nodes extension installed. Complete system compromise is possible, including data theft, malware installation, and lateral movement within the network.

Affected Products

• ComfyUI-Bmad-Nodes (comfyui_bmad_nodes)
• ComfyUI installations with Bmad-Nodes custom nodes enabled
• Systems running the vulnerable cv_nodes.py module

Discovery Timeline

• 2024-12-13 - CVE-2024-21576 published to NVD
• 2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-21576

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The root issue lies in the unsafe use of Python's eval() function within the custom node implementations. When user-controlled input reaches the eval() call without proper sanitization, an attacker can inject arbitrary Python code that will be executed in the context of the server process.

The affected nodes—BuildColorRangeHSVAdvanced, FilterContour, and FindContour—are designed to process image data and contour information. However, the validation mechanisms meant to sanitize input before the eval() call can be bypassed, allowing malicious payloads to pass through.

The vulnerability is network-accessible with no authentication required, no user interaction needed, and has a trivial attack complexity. Successful exploitation provides attackers with complete control over confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is the improper use of Python's eval() function on user-controllable input. The eval() function interprets strings as Python code, making it inherently dangerous when processing untrusted data. In the vulnerable code located in cv_nodes.py, the validation mechanisms intended to prevent code injection can be bypassed through crafted workflow inputs. This is a classic example of trusting user input in a context where code execution is possible.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Creating a malicious ComfyUI workflow containing a crafted payload string
2. Targeting one of the vulnerable nodes (BuildColorRangeHSVAdvanced, FilterContour, or FindContour)
3. Injecting a specially crafted string that bypasses the validation logic
4. The string reaches the eval() call and executes arbitrary Python code on the server

The vulnerability in the cv_nodes.py module allows attackers to inject arbitrary Python expressions that bypass the input validation. When a malicious workflow is processed, the injected code executes with full server privileges. For technical implementation details, see the vulnerable code reference on GitHub.

Detection Methods for CVE-2024-21576

Indicators of Compromise

• Unexpected Python processes spawned by ComfyUI with unusual command-line arguments
• Network connections to external command and control servers originating from the ComfyUI process
• Unusual file system activity in the ComfyUI installation directory or system-wide
• Workflow files containing obfuscated or suspicious string patterns in node parameters

Detection Strategies

• Monitor ComfyUI logs for errors or exceptions related to the BuildColorRangeHSVAdvanced, FilterContour, and FindContour nodes
• Implement application-level logging to capture all inputs passed to the vulnerable nodes
• Deploy endpoint detection solutions capable of identifying Python code injection patterns
• Use Web Application Firewalls (WAF) to inspect workflow submissions for malicious payloads

Monitoring Recommendations

• Enable verbose logging for ComfyUI and the Bmad-Nodes extension
• Monitor process creation events for any child processes spawned by the Python interpreter running ComfyUI
• Track network connections originating from the ComfyUI process for connections to unusual destinations
• Implement file integrity monitoring on the ComfyUI installation directory

How to Mitigate CVE-2024-21576

Immediate Actions Required

• Disable the BuildColorRangeHSVAdvanced, FilterContour, and FindContour nodes until a patch is available
• Restrict network access to ComfyUI instances to trusted users and networks only
• Review ComfyUI logs for signs of exploitation attempts
• Consider temporarily disabling the Bmad-Nodes extension entirely if the affected nodes are not critical to operations

Patch Information

At the time of CVE publication, no official patch information was available. Users should monitor the ComfyUI-Bmad-Nodes GitHub repository for updates and security advisories. When a patched version becomes available, update immediately and restart all ComfyUI instances.

Workarounds

• Remove or comment out the eval() calls in cv_nodes.py if the affected node functionality is not required
• Implement network segmentation to isolate ComfyUI instances from critical infrastructure
• Deploy ComfyUI behind a reverse proxy with strict input validation rules
• Run ComfyUI in a containerized environment with minimal privileges and restricted network access

# Example: Restrict ComfyUI to localhost only
# In your ComfyUI startup configuration or command:
python main.py --listen 127.0.0.1 --port 8188

# If using Docker, limit network exposure:
docker run -d --name comfyui \
  -p 127.0.0.1:8188:8188 \
  --read-only \
  --security-opt=no-new-privileges:true \
  comfyui-image