Executive brief
Komari is a server monitoring and client management platform. The administrative interface is vulnerable to cross-site request forgery attacks because session cookies lack SameSite and Secure attributes. An attacker can trick an authenticated administrator into visiting a malicious website to execute arbitrary commands on managed systems, disable security features, or delete monitoring data.
Technical details
The session_token cookie is set without SameSite or Secure attributes, and all /api/admin/ endpoints rely solely on cookie-based authentication with no CSRF token validation. While modern browsers (Chrome 80+, Firefox 103+, Safari) default to SameSite=Lax and mitigate exploitation via cross-site HTML forms, the vulnerability remains exploitable through legacy browsers, man-in-the-middle attacks over HTTP, and same-origin XSS contexts. High-impact operations including arbitrary command execution, 2FA disabling, and configuration modification are reachable.
Affected products
- komari-monitor Komari <= 1.2.0
Timeline
- 2026-06-20: disclosed
- 2026-06-09: patched: Release 1.2.2