N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-q355-h244-969h

GHSA-q355-h244-969h: Komari vulnerable to Cross-site WebSocket Hijacking

Summary

WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks against authenticated users

Details

https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.go#L33-L35

Any third party website can send requests to the terminal websocket endpoint with browser's cookies, resulting in remote code execution

PoC

Login in to your komari instance
Hosting the following HTML code on internet, replace <komari-addr> and <target-uuid> into yours
Visit this HTML page, you can see your node is executing uptime without your actions

<pre></pre>
<script>
const socket = new WebSocket("wss://<komari-addr>/api/admin/client/<target-uuid>/terminal");
socket.addEventListener("open", (event) => {
  const binaryBlob = new Blob(['uptime\n'], { type: 'application/octet-stream' });
  socket.send(binaryBlob);
});
socket.addEventListener("message", (event) => {
  event.data.text().then(x => {document.querySelector("pre").append(x)});
});
</script>

Impact

An administrator of a Komari instance will execute commands on their nodes unnoticed when visiting a malware page.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-q355-h244-969h

GHSA-q355-h244-969h:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/komari-monitor/komari	go	< 0.0.0-20250809073044-53171affcaf0	0.0.0-20250809073044-53171affcaf0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-q355-h244-969h, is a classic case of Cross-Site WebSocket Hijacking (CSWSH). The root cause is the disabled origin check in multiple WebSocket endpoint handlers within the Komari application. The github.com/gorilla/websocket library's Upgrader has a CheckOrigin field, which is a function that should validate if the request's Origin header is allowed. In the vulnerable versions of Komari, this function was set to func(r *http.Request) bool { return true }, completely bypassing this critical security check.

This misconfiguration allows any third-party website to initiate a WebSocket connection to the Komari instance's WebSocket endpoints. Since browsers automatically include cookies with cross-origin requests, an authenticated administrator visiting a malicious webpage could have their session hijacked. The malicious page could then establish a WebSocket connection in the background and send commands to the administrator's managed nodes, as demonstrated in the Proof of Concept, resulting in unauthorized remote code execution.

The fixing commit 53171affcaf050145810efaaef420651a6e630be addresses this by introducing a centralized, secure ws.CheckOrigin function that properly validates the Origin header against the Host header of the request. This new function is then applied to the WebSocket upgraders in the affected parts of the codebase, ensuring that only requests from trusted origins can establish WebSocket connections. The analysis identified four distinct functions (api.RequestTerminal, client.EstablishConnection, client.WebSocketReport, and ws.GetClients) that were vulnerable due to this issue.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.