Executive brief
Komari is a monitoring platform used to manage and execute tasks on remote nodes. Its administrative interface lacks cross-site request forgery (CSRF) protection, meaning an attacker can trick an authenticated administrator into performing unauthorized actions such as executing shell commands on managed nodes, disabling two-factor authentication, or clearing monitoring records. While modern browsers block such attacks by default, the vulnerability remains exploitable in older browsers or if the administrator is already compromised by XSS malware.
Technical details
This is a cross-site request forgery (CSRF) vulnerability affecting all /api/admin/ endpoints in Komari. The root cause is twofold: (1) the session_token cookie is set without the SameSite or Secure attributes (login.go:68), and (2) all admin endpoints rely solely on this cookie for authentication with no CSRF token validation or Origin checks. An attacker can craft a malicious webpage that, when visited by an authenticated administrator, submits state-changing requests (POST to /api/admin/task/exec, /api/admin/2fa/disable, /api/admin/settings/, etc.). In modern browsers (Chrome 80+, Firefox 103+, Safari), cookies without an explicit SameSite attribute default to SameSite=Lax, blocking cross-site POST cookies and mitigating the attack. However, the vulnerability remains exploitable in legacy browsers (<Chrome 80), within the same-origin context (via XSS or console access), or over HTTP (where Secure=false). The patched version (0.0.0-20260609084633-98122fa4d110) fixes the vulnerability.
Affected products
- Komari Monitor Komari < 0.0.0-20260609084633-98122fa4d110
Timeline
- 2026-06-20: disclosed: Published to GitHub Advisory Database
- 2026-06-09: patched: Patch released in version 0.0.0-20260609084633-98122fa4d110
- 2026-09-09: advisory: Advisory updated