CVE-2024-21577: ComfyUI-Ace-Nodes RCE Vulnerability

CVE-2024-21577 Overview

CVE-2024-21577 is a critical code injection vulnerability affecting ComfyUI-Ace-Nodes, a custom node extension for the ComfyUI AI image generation platform. The vulnerability exists in the ACE_ExpressionEval node, which contains an unsafe eval() function call in its entrypoint that accepts arbitrary user-controlled data. An attacker can craft a malicious workflow that results in executing arbitrary code on the server hosting the ComfyUI instance.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected servers through specially crafted workflows, potentially leading to complete system compromise, data theft, and lateral movement within the network.

Affected Products

• ComfyUI-Ace-Nodes (all versions with the vulnerable ACE_ExpressionEval node)
• ComfyUI installations with ComfyUI-Ace-Nodes plugin enabled

Discovery Timeline

• 2024-12-13 - CVE-2024-21577 published to NVD
• 2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-21577

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The ACE_ExpressionEval node in ComfyUI-Ace-Nodes provides expression evaluation functionality that directly passes user-controlled input to Python's eval() function without proper sanitization or sandboxing. This represents a fundamental secure coding violation, as eval() should never be used with untrusted input.

The vulnerable code is located in the nodes.py file at line 1193 of the ComfyUI_AceNodes repository. When a user creates or loads a workflow containing the ACE_ExpressionEval node, any expression provided as input is executed directly in the Python interpreter context with full server-side privileges.

Root Cause

The root cause of this vulnerability is the direct use of Python's eval() function on user-supplied input without any input validation, sanitization, or execution sandboxing. The eval() function is inherently dangerous as it can execute arbitrary Python code, including system commands, file operations, and network communications. The developer did not implement any protective measures such as:

• Input validation or allowlisting of permitted expressions
• Abstract Syntax Tree (AST) parsing with restricted node types
• Sandboxed execution environments
• Principle of least privilege for the execution context

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Creating a malicious ComfyUI workflow that includes the ACE_ExpressionEval node
2. Injecting arbitrary Python code as the expression parameter
3. Submitting or sharing the workflow to be executed on a target ComfyUI server

The vulnerability exists in the entrypoint function of the ACE_ExpressionEval node. When the workflow is processed, the malicious expression is passed directly to eval(), resulting in arbitrary code execution with the privileges of the ComfyUI server process.

Exploitation could include importing system modules like os or subprocess to execute shell commands, reading sensitive files, establishing reverse shells, or pivoting to other systems on the network. For technical details, see the vulnerable code in the GitHub repository.

Detection Methods for CVE-2024-21577

Indicators of Compromise

• Unexpected outbound network connections from the ComfyUI server process
• Suspicious child processes spawned by the Python interpreter running ComfyUI
• Unusual file system access patterns, particularly reads of sensitive configuration files or writes to system directories
• Workflow files containing ACE_ExpressionEval nodes with complex or obfuscated expressions
• Presence of imported system modules (os, subprocess, socket) in expression evaluation contexts

Detection Strategies

• Monitor for the use of ACE_ExpressionEval nodes in workflow submissions, particularly those with expressions containing import, __, exec, or eval keywords
• Implement process monitoring to detect child processes spawned by the ComfyUI application
• Deploy network monitoring to identify anomalous outbound connections from ComfyUI server instances
• Analyze workflow JSON files for suspicious patterns in expression fields before execution

Monitoring Recommendations

• Enable comprehensive logging for all ComfyUI workflow executions and node evaluations
• Deploy endpoint detection and response (EDR) solutions to monitor for code injection attack patterns
• Implement application-level firewalls to restrict outbound connections from ComfyUI servers
• Configure alerts for any process execution originating from the ComfyUI application context that attempts to access system utilities

How to Mitigate CVE-2024-21577

Immediate Actions Required

• Disable or remove the ACE_ExpressionEval node from ComfyUI-Ace-Nodes installations immediately
• Audit all existing workflows for the presence of ACE_ExpressionEval nodes and review their contents
• Restrict network access to ComfyUI instances, limiting exposure to trusted users only
• Consider running ComfyUI in a containerized or sandboxed environment with restricted permissions
• Monitor for any vendor patches or security updates to ComfyUI-Ace-Nodes

Patch Information

At the time of publication, no official patch has been released for this vulnerability. Users should monitor the ComfyUI_AceNodes GitHub repository for security updates. Until a patch is available, the recommended approach is to completely disable or remove the vulnerable ACE_ExpressionEval node.

Workarounds

• Remove or comment out the ACE_ExpressionEval node class from the nodes.py file
• Implement network segmentation to isolate ComfyUI servers from critical infrastructure
• Deploy web application firewalls (WAF) to filter potentially malicious workflow submissions
• Run ComfyUI with minimal system privileges using a dedicated service account with restricted filesystem and network access
• If expression evaluation is required, consider implementing a custom solution using Python's ast.literal_eval() for safe evaluation of literal expressions only

# Configuration example - Disable ACE_ExpressionEval node
# Navigate to ComfyUI-Ace-Nodes installation directory
cd /path/to/ComfyUI/custom_nodes/ComfyUI_AceNodes

# Backup and modify nodes.py to disable the vulnerable node
cp nodes.py nodes.py.backup

# Comment out or remove the ACE_ExpressionEval class registration
# Alternatively, remove the entire plugin if not needed
rm -rf /path/to/ComfyUI/custom_nodes/ComfyUI_AceNodes