PT-2025-33680 · Komari · Komari

Imlonghao · Published 2025-08-12 · Updated 2025-08-21 · CVE-2025-55300

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Komari versions prior to 1.0.4-fix1

Description: Komari is a server monitoring tool. A Cross-Site WebSocket Hijacking (CSWSH) issue exists in the WebSocket upgrader due to disabled origin checking, potentially allowing remote code execution against authenticated users. An attacker can send requests to the terminal websocket endpoint with the victim's browser cookies.

Recommendations: Update to version 1.0.4-fix1 or later.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-1385

CWE-79

Related Identifiers

CVE-2025-55300

GHSA-Q355-H244-969H

GO-2025-3874

Affected Products

Komari

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55300.json · Exploit
• https://osv.dev/vulnerability/GO-2025-3874 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55300 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q355-h244-969h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55300 · Security Note
• https://github.com/komari-monitor/komari/commit/d31d12e59febce100ab0285b93338f09aa5d6cb1 · Note
• https://github.com/komari-monitor/komari/releases/tag/1.0.4-fix2 · Note
• https://github.com/komari-monitor/komari · Note
• https://github.com/komari-monitor/komari/security/advisories/GHSA-q355-h244-969h · Note
• https://github.com/komari-monitor/komari/blob/bd5a6934e1b79a12cf1e6a9bba5372d0e04f3abc/api/terminal.go#L33-L35 · Note
• https://github.com/komari-monitor/komari/commit/53171affcaf050145810efaaef420651a6e630be · Note
• https://twitter.com/SecAideInfo/status/1958472998996107718 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1957528920497979710 · Twitter Post
• https://t.me/CVEtracker/30296 · Telegram Post
• https://twitter.com/CVEnew/status/1957500986672496763 · Twitter Post