A critical CRLF injection vulnerability in ComfyUI-Manager permits unauthenticated attackers to tamper with system configurations, risking unauthorized application behavior modification.

This vulnerability is a CRLF injection (CWE-93) flaw where an unauthenticated attacker can inject special characters into HTTP query parameters. This manipulation enables the attacker to write arbitrary values into the config.ini file, affecting application settings.

The ability for an unauthenticated user to modify the configuration of ComfyUI-Manager poses a significant risk to system integrity. By tampering with the config.ini file, an attacker could potentially disable security controls, alter application functionality, or redirect system operations. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized configuration changes that could facilitate further compromise.

Immediate Action: Upgrade ComfyUI-Manager to version 3.39.2 or 4.0.5 immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review application logs for suspicious HTTP requests containing carriage return (CR) or line feed (LF) characters in query parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block HTTP requests that contain CRLF sequences or unexpected control characters in URI parameters.

Public Exploit Available: No

The vulnerability presents a clear risk to the integrity of the ComfyUI-Manager extension. Organizations should prioritize patching to the specified fixed versions to eliminate the injection vector. Given the ease of exploitation, failure to update the software promptly leaves the environment susceptible to configuration tampering by external actors.