Server-side Request Forgery (SSRF)signalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the makeRemoteRequest function. An attacker can access internal network resources, cloud metadata services, and arbitrary external hosts by supplying crafted parameters to administrative endpoints without authentication. This allows exfiltration of sensitive data, internal network scanning, and interaction with internal APIs. The attacker can also bypass TLS certificate verification by setting the selfsignedcert parameter, and exploit path traversal in the checkAccessRequest endpoint to target arbitrary paths on the destination host. This is only exploitable if the server is running with default security settings and no admin user is configured.
How to fix Server-side Request Forgery (SSRF)? Upgrade signalk-server to version 2.28.0 or higher.
| |
Brute Forcesignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Brute Force via the processLoginRequest function. An attacker can gain unauthorized access by sending unlimited authentication attempts over a WebSocket connection, bypassing rate limiting protections that are enforced on HTTP endpoints.
How to fix Brute Force? Upgrade signalk-server to version 2.25.0 or higher.
| |
Regular Expression Denial of Service (ReDoS)signalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the contextMatcher and pathMatcher functions. An attacker can cause the server to become unresponsive and exhaust CPU resources by sending specially crafted WebSocket subscription payloads containing malicious regular expression patterns in the context parameter.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade signalk-server to version 2.25.0 or higher.
| |
Authentication Bypass Using an Alternate Path or Channelsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the /skServer/enableSecurity endpoint. An attacker can gain unauthorized administrative privileges by sending crafted requests that inject a new admin account, due to the endpoint remaining accessible and blindly trusting the type field in the request body.
How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade signalk-server to version 2.24.0-beta.4 or higher.
| |
Out-of-bounds Readsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Out-of-bounds Read in the from field of JSON-patch operations. An attacker can access internal Node.js functions and prototype state by crafting a payload that targets prototype properties, thereby exfiltrating sensitive internal data into their own application data.
How to fix Out-of-bounds Read? Upgrade signalk-server to version 2.24.0 or higher.
| |
Missing Authentication for Critical Functionsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the PUT /signalk/v1/api/sourcePriorities endpoint, which lacks authentication and directly assigns user input to configuration. An attacker can alter trusted navigation data sources and persist these changes across server restarts by sending crafted requests to the unauthenticated endpoint.
How to fix Missing Authentication for Critical Function? Upgrade signalk-server to version 2.24.0-beta.3 or higher.
| |
Directory Traversalsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Directory Traversal via improper validation in the validateAppId function. An attacker can access arbitrary files and directories outside the intended directory by supplying specially crafted input containing backslashes as directory separators on Windows systems. This may allow reading, writing, or listing sensitive files with the privileges of the authenticated user.
How to fix Directory Traversal? Upgrade signalk-server to version 2.20.3 or higher.
| |
Authentication Bypass Using an Alternate Path or Channelsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the startServerEvents and queryRequest functions. When allow_readonly is enabled, an unauthenticated attacker can obtain authentication tokens for any user by enumerating WebSocket events to discover access request IDs and then polling the access request status endpoint to retrieve issued tokens.
How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade signalk-server to version 2.19.0-beta.5 or higher.
| |
Arbitrary Code Injectionsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Arbitrary Code Injection via the appstore.js REST API endpoint, which allows the installation of npm packages using unsanitized version specifiers. An administrator can execute arbitrary commands on the server by supplying a malicious package source containing a crafted postinstall script. The package source is passed in as a version specifier, which is valid according to npm specifications, and loads the malicious code upon install.
How to fix Arbitrary Code Injection? Upgrade signalk-server to version 2.19.0-beta.5 or higher.
| |
Allocation of Resources Without Limits or Throttlingsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the /signalk/v1/access/requests endpoint. An attacker can cause the server to exhaust memory resources and crash by sending a large number of unauthenticated POST requests containing large payloads.
How to fix Allocation of Resources Without Limits or Throttling? Upgrade signalk-server to version 2.19.0-beta.5 or higher.
| |
Improper Control of Dynamically-Managed Code Resourcessignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the restoreFilePath global variable, which can be manipulated through the /skServer/validateBackup endpoint. An attacker with the relevant access, can gain unauthorized administrative access and execute arbitrary system commands by uploading a crafted backup file and leveraging the restore process to overwrite critical configuration files.
How to fix Improper Control of Dynamically-Managed Code Resources? Upgrade signalk-server to version 2.19.0-beta.5 or higher.
| |
Information Exposuresignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to Information Exposure via the exposed endpoints /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer that are not protected by authentication middleware. An unauthenticated attacker can access sensitive system information, including the full data schema, connected serial devices, and installed analyzer tools.
How to fix Information Exposure? Upgrade signalk-server to version 2.19.0-beta.5 or higher.
| |
User Impersonationsignalk-server is an An implementation of a Signal K server for boats.
Affected versions of this package are vulnerable to User Impersonation via the access request system. An attacker can obtain elevated privileges and impersonate trusted devices by submitting misleading descriptions, spoofing internal IP addresses through the X-Forwarded-For header, and requesting higher permissions than indicated. This increases the likelihood of administrator approval through social engineering.
How to fix User Impersonation? Upgrade signalk-server to version 2.19.0-beta.5 or higher.
| |
