PT-2024-17824 · Comfy Mtb+1 · Comfy Mtb+1

Boy-Hack + 1 · Published 2024-12-26 · Updated 2024-12-26 · CVE-2024-12952

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions melMass comfy mtb versions up to 0.1.4

Description A critical vulnerability was found in the Dependency Handler component, specifically in the run command function of the file comfy mtb/endpoint.py. This vulnerability leads to code injection and can be exploited remotely. The exploit has been disclosed to the public.

Recommendations For melMass comfy mtb versions up to 0.1.4, apply the patch named d6e004cce2c32f8e48b868e66b89f82da4887dc3 to fix this issue. As a temporary workaround, consider disabling the run command function until the patch is applied. Restrict access to the vulnerable comfy mtb/endpoint.py file to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2024-12952

Affected Products

Comfy Mtb

Melmass

References · 13

• 🔥 https://github.com/melMass/comfy_mtb/issues/224#issuecomment-2552664778 · Exploit
• 🔥 https://github.com/melMass/comfy_mtb/issues/224#issuecomment-2553432365 · Exploit
• 🔥 https://github.com/melMass/comfy_mtb/issues/224 · Exploit
• https://github.com/melMass/comfy_mtb/commit/d6e004cce2c32f8e48b868e66b89f82da4887dc3 · Patch
• https://osv.dev/vulnerability/CVE-2024-12952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12952 · Security Note
• https://vuldb.com/?id.289315 · Note
• https://vuldb.com/?submit.468683 · Note
• https://twitter.com/VulmonFeeds/status/1872323774193791165 · Twitter Post
• https://t.me/cvedetector/13678 · Telegram Post
• https://twitter.com/CVEnew/status/1872271630317318325 · Twitter Post
• https://vuldb.com/?ctiid.289315 · Note
• https://t.me/cvenotify/105490 · Telegram Post