PT-2025-33680 · Komari · Komari

Imlonghao · Publicado 2025-08-12 · Atualizado 2025-08-21 · CVE-2025-55300

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Komari versions prior to 1.0.4-fix1

Description: Komari is a server monitoring tool. A Cross-Site WebSocket Hijacking (CSWSH) issue exists in the WebSocket upgrader due to disabled origin checking, potentially allowing remote code execution against authenticated users. An attacker can send requests to the terminal websocket endpoint with the victim's browser cookies.

Recommendations: Update to version 1.0.4-fix1 or later.

Exploit

Correção

RCE

XSS

Enumeração de Fraquezas

CWE-1385

CWE-79

Identificadores relacionados

CVE-2025-55300

GHSA-Q355-H244-969H

GO-2025-3874

Produtos afetados

Komari

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55300.json · Exploit
• https://github.com/komari-monitor/komari/commit/d31d12e59febce100ab0285b93338f09aa5d6cb1 · Nota
• https://github.com/komari-monitor/komari/releases/tag/1.0.4-fix2 · Nota
• https://github.com/komari-monitor/komari · Nota
• https://github.com/komari-monitor/komari/security/advisories/GHSA-q355-h244-969h · Nota
• https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.go#L33-L35 · Nota
• https://github.com/komari-monitor/komari/commit/53171affcaf050145810efaaef420651a6e630be · Nota
• https://osv.dev/vulnerability/GO-2025-3874 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-55300 · Aviso do Fabricante
• https://twitter.com/SecAideInfo/status/1958472998996107718 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1957528920497979710 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-q355-h244-969h · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-55300 · Nota de Segurança
• https://t.me/CVEtracker/30296 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1957500986672496763 · Publicação no Twitter