GHSA-hxjg-93wc-h8p8: Cross-Site Request Forgery in Komari Management Interface
Vulnerability ID: GHSA-HXJG-93WC-H8P8
CVSS Score: 8.8
Published: 2026-09-09
A high-severity Cross-Site Request Forgery (CSRF) vulnerability exists in the Komari server monitoring tool. The administrative interface sets authentication cookies without restrictive SameSite or Secure attributes, and lacks any CSRF validation, enabling unauthenticated remote attackers to execute arbitrary commands or modify backend settings by exploiting administrative sessions.
TL;DR
Unauthenticated remote attackers can execute arbitrary shell commands on managed nodes and disable administrative 2FA by tricking an authenticated administrator into visiting a malicious link.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-352 (Cross-Site Request Forgery)
- Attack Vector: Network (AV:N)
- CVSS Severity: 8.8 (High)
- Exploit Maturity: Proof of Concept (PoC)
- Impact: Remote Code Execution / Privilege Escalation
- First Patched Version: 1.2.2
Affected Systems
- Komari Monitoring Server (github.com/komari-monitor/komari)
-
github.com/komari-monitor/komari: < 0.0.0-20260609084633-98122fa4d110 (Fixed in:
1.2.2)
Mitigation Strategies
- Explicitly configure the session cookie with 'Secure=true' and 'SameSite=Lax' properties.
- Implement CSRF validation middleware on all state-changing endpoints (/api/admin/*).
- Utilize Double-Submit Cookie patterns or custom HTTP header validation.
Remediation Steps:
- Upgrade the Komari server application to version 1.2.2 or higher.
- If immediate upgrade is not viable, enforce reverse-proxy level validation of the HTTP 'Origin' and 'Referer' headers.
- Enable HTTPS strictly to prevent session cookie leakage over unencrypted channels.
References
Read the full report for GHSA-HXJG-93WC-H8P8 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)