{"uuid": "dbd538ea-d58e-4296-9146-231b1d9b971a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-HXJG-93WC-H8P8", "type": "seen", "source": "https://gist.github.com/alon710/cd4bf1198b3a3ab59c651c0e272e75c0", "content": "# GHSA-HXJG-93WC-H8P8: GHSA-hxjg-93wc-h8p8: Cross-Site Request Forgery in Komari Management Interface\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-09\n> **Full Report:** https://cvereports.com/reports/GHSA-HXJG-93WC-H8P8\n\n## Summary\nA high-severity Cross-Site Request Forgery (CSRF) vulnerability exists in the Komari server monitoring tool. The administrative interface sets authentication cookies without restrictive SameSite or Secure attributes, and lacks any CSRF validation, enabling unauthenticated remote attackers to execute arbitrary commands or modify backend settings by exploiting administrative sessions.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary shell commands on managed nodes and disable administrative 2FA by tricking an authenticated administrator into visiting a malicious link.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-352 (Cross-Site Request Forgery)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 8.8 (High)\n- **Exploit Maturity**: Proof of Concept (PoC)\n- **Impact**: Remote Code Execution / Privilege Escalation\n- **First Patched Version**: 1.2.2\n\n## Affected Systems\n\n- Komari Monitoring Server (github.com/komari-monitor/komari)\n- **github.com/komari-monitor/komari**: < 0.0.0-20260609084633-98122fa4d110 (Fixed in: `1.2.2`)\n\n## Mitigation\n\n- Explicitly configure the session cookie with 'Secure=true' and 'SameSite=Lax' properties.\n- Implement CSRF validation middleware on all state-changing endpoints (/api/admin/*).\n- Utilize Double-Submit Cookie patterns or custom HTTP header validation.\n\n**Remediation Steps:**\n1. Upgrade the Komari server application to version 1.2.2 or higher.\n2. If immediate upgrade is not viable, enforce reverse-proxy level validation of the HTTP 'Origin' and 'Referer' headers.\n3. Enable HTTPS strictly to prevent session cookie leakage over unencrypted channels.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/komari-monitor/komari/security/advisories/GHSA-hxjg-93wc-h8p8)\n- [Komari Release Tag 1.2.2](https://github.com/komari-monitor/komari/releases/tag/1.2.2)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-HXJG-93WC-H8P8) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-10T05:31:15.721426Z"}