ComfyUI Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability affects ComfyUI versions prior to 0.2.2. This issue allows attackers to create malicious websites that, when accessed by authenticated ComfyUI users, can execute arbitrary API requests on their behalf. Exploitation could involve uploading arbitrary files through the '/upload/image' endpoint. The absence of CSRF protections on several API endpoints, including '/upload/image', '/prompt', and '/history', exposes users to unauthorized actions. This vulnerability could potentially be exploited in conjunction with other issues, such as stored cross-site scripting, to further compromise user sessions.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the user, such as uploading arbitrary files to the application.