T09 · Insecure Skill Coding Practices
Error
- Location
scripts/comfyui_executor.py:356- Finding
Server-Controlled Path Traversal Allows Arbitrary Local File Overwrite
- Content
View full analysis
= 400: return None # 保存文件 output_file = output_path / filename with open(output_file, "wb") as f: f.write(response.content) ``` ### Technical Analysis The `filename` value is obtained from the ComfyUI server's execution-history response. The code joins this remotely controlled value directly to the user-selected output directory without validating whether it is an absolute path or contains traversal components such as `..`. Python's `pathlib` permits the resulting path to escape `output_path`. If `filename` is absolute, it can replace the preceding directory entirely. If it contains traversal sequences, the resolved destination can point outside the output directory. The use of `"wb"` also truncates and overwrites an existing destination file. The implementation performs no canonicalization, containment check, filename normalization, symlink defense, or overwrite confirmation. ### Attack Path 1. A user connects the Skill to a compromised or attacker-controlled ComfyUI server, including through the supported `--server-url` option. 2. The user submits a workflow and the client polls the server for execution history. 3. The malicious server returns an output entry such as: ```json { "images": [ { "filename": "../../.bashrc", "subfolder": "", "type": "output" } ] } ``` 4. The client requests the corresponding content from `/view`. 5. The client evaluates `output_path / "../../.bashrc"` without checking the resolved locatio ...[truncated 817 chars]- Remediation
View remediation