While modern browsers implement SameSite=Lax by default - which hinders cross-site POST requests - the application remains susceptible in same-origin contexts, when accessed via legacy browsers, or during Man-in-the-Middle (MitM) attacks due to the missing Secure flag. Successful exploitation enables unauthorized actors to perform high-impact operations, including executing shell commands via /api/admin/task/exec, disabling 2FA, and modifying system configurations. This vulnerability stems from inadequate middleware configuration in the underlying Gin framework implementation.

Attack Chain

1. Attacker identifies the target instance of the Komari management console.
2. Attacker crafts a malicious payload (e.g., HTML form or JavaScript fetch request) targeting a sensitive endpoint such as /api/admin/task/exec.
3. Attacker lures an authenticated administrative user to a malicious site or injects the payload via existing XSS vulnerabilities in the target's environment.
4. The victim's browser initiates the unauthorized request to the Komari API.
5. The server receives the request, including the non-secure session_token cookie, which is automatically included by the browser if the environment does not strictly enforce SameSite=Lax or if it is a same-origin request.
6. The server application, lacking CSRF middleware, processes the request as legitimate, assuming it originated from the administrative interface.
7. The intended administrative operation (e.g., code execution or configuration change) is performed on the server or managed nodes.

Impact

Successful exploitation allows attackers to bypass administrative authentication. Impacted operations include the execution of arbitrary shell commands on managed nodes, complete disabling of administrator 2FA, deletion of monitoring records, and modification of system settings. This could lead to a total compromise of the managed infrastructure and the Komari monitoring server itself.

Recommendation

Prioritize updating the Komari package to version 0.0.0-20260609084633-98122fa4d110 or later. Ensure that webserver-level headers are configured to prevent cross-site request forgery and that the application is served exclusively over HTTPS with cookies flagged as Secure and SameSite=Strict. For detection engineering, monitor webserver access logs for anomalous POST requests to /api/admin/ paths that do not originate from the expected internal management source IPs or authorized referrers.