GHSA-hxjg-93wc-h8p8

# Vulnerability Overview The `session_token` cookie is set **without** the `SameSite` or `Secure` attributes (`login.go:68`). All `/api/admin/` management endpoints rely solely on this cookie for authentication, with **no CSRF token or Origin validation**. **The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default `SameSite=Lax` behavior.** ## Root Cause ```go // komari-main/api/public/login.go:68 c.SetCookie("session_token", session, 2592000, "/", "", false, true) // Secure=false, SameSite not explicitly set // Admin route group (server.go:213-343) has no CSRF middleware ``` Gin's `ShouldBindJSON` does not strictly validate the `Content-Type` header, allowing `text/plain` requests to bypass CORS preflight. ## Browser Limitations - Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to `SameSite=Lax`. - Cookies without an explicit `SameSite` attribute **are not included in cross-site POST requests**. - As a result, the server receives requests without the session cookie and returns **HTTP 401 Unauthorized**. | Scenario | Exploitable | |----------|-------------| | Cross-site HTML (modern browsers) | ✗ Blocked by `SameSite=Lax` | | Cross-site HTML (Chrome <80 / legacy browsers) | ✓ | | Same-origin context (Browser Console / existing XSS) | ✓ | | Man-in-the-middle over HTTP (`Secure=false`) | ✓ | ## High-Impact Operations Reachable via CSRF | Endpoint | Method | Impact | |----------|--------|--------| | `/api/admin/task/exec` | POST | Execute arbitrary shell commands on managed nodes | | `/api/admin/2fa/disable` | POST | Disable administrator two-factor authentication | | `/api/admin/settings/` | POST | Modify system configuration | | `/api/admin/upload/backup` | POST | Upload a malicious backup | | `/api/admin/record/clear/all` | POST | Delete all monitoring records | | `/api/admin/client/:uuid/edit` | POST | Modify client conf