Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
16 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The app store icon code (`dist/appstore/icon-probe.js` around line 200 and `icon-bytes.js` around line 138) resolves a plugin's declared `signalk.appIcon`. Relative paths are pinned to the CDN, but an absolute http(s) URL is used as-is: the server fetches it, follows redirects, and stores any `image/*` response as the plugin's icon, which is then served to the admin UI. Unrelated to GHSA-q59x-jc9f-gfqf. Affected signalk-server 2.33.0 (latest). Reproduction The real dist modules driven directly, Docker with `--network none`; a local "internal" service on 127.0.0.1 logs requests: ``` [CONTROL relative] declared=../../icon.png resolved=null internal-service hits: [] stored: null [ATTACK absolute] declared=http://127.0.0.1:35013/latest/meta-data/iam resolved=http://127.0.0.1:35013/latest/meta-data/iam internal-service hits: ["GET /latest/meta-data/iam"] stored: .../icon-bytes/evil-plugin@1.0.0.png (70 bytes) [ATTACK redirect] declared=http://127.0.0.1:35013/redir…
Recommended action: Upgrade to 2.34.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading /security.json discloses the JWT signing secret, enabling admin token forgery and remote code execution. Details Description The v2 REST resources API `GET /signalk/v2/api/resources/:resourceType/:resourceId` passes `resourceId` to `FileStore.getResource()` without validation. `getResource()` builds the file path with `path.join(this.resources[type].path, itemUuid)` followed by `readFile` + `JSON.parse`, so a `%2F`-encoded multi-level traversal (`..%2F..%2F..%2F..%2F`) escapes the resource storage directory and returns any JSON file on the server (source: `src/api/resources/index.ts:559-600`, `packages/resources-provider-plugin/src/filestorage.ts:115-125`). Because the JWT signing secret is stored in plaintext in ` /security.json` (generated at `src/tokensecurity.ts:271`, persisted via…
Recommended action: Upgrade to 2.34.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery (SSRF) vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest() function accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without any validation, allowing an attacker to force the server to make arbitrary HTTP/HTTPS requests to internal network resources, cloud metadata services, and other unintended destinations. When security is not configured (the default state), these endpoints require no authentication. Details Vulnerable Function The core vulnerability is in makeRemoteRequest() at src/serverroutes.ts:2483-2524: Missing Validation The function performs zero validation on the destination host. The following address ranges are all reachable: - Loopback: 127.0.0.1, ::1, localhost - RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - Link-local / Cloud metadata:…
Recommended action: Upgrade to 2.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). Details Vulnerable code: src/interfaces/ws.ts, function processLoginRequest (lines 753-780) The function directly calls app.securityStrategy.login(msg.login.username, msg.login.password) with no throttling or attempt tracking. Rate-limited HTTP path for comparison: src/tokensecurity.ts lines 609-617 apply loginLimiter middleware to the HTTP login routes at line 637. Steps to Reproduce 1. Start Signal K server with…
Recommended action: Upgrade to 2.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SignalK server is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack within its WebSocket subscription handling logic. By injecting unescaped regex metacharacters into the context parameter of a stream subscription, an attacker can force the server's Node.js event loop into a catastrophic backtracking loop when evaluating long string identifiers (like the server's self UUID). This results in a total Denial of Service (DoS) where the server CPU spikes to 100% and becomes completely unresponsive to further API or socket requests. Description The vulnerability stems from flawed string-to-regex conversion in signalk-server/src/subscriptionmanager.ts. The contextMatcher() and pathMatcher() functions convert wildcard strings (e.g., ) into regular expressions to match incoming data against client subscriptions. While the code attempts to escape . and characters, it fails to escape other dangerous regular expression metacharacters—such as +, (,…
Recommended action: Upgrade to 2.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SignalK Server contains a code-level vulnerability in its OIDC login and logout handlers where the unvalidated HTTP Host header is used to construct the OAuth2 redirecturi. Because the redirectUri configuration is silently unset by default, an attacker spoof the Host header to steal OAuth authorization codes and hijack user sessions in realistic deployments as The OIDC provider will then send the authorization code to whatever domain was injected. The OIDC specification requires redirecturi to be pre-registered and not derived from untrusted input. Constructing it from the Host header violates this requirement and introduces a trust boundary break. This risk is actively amplified by SignalK's official documentation, which instructs administrators to deploy an Nginx configuration that forwards the vulnerable Host header, exposing production environments. Vulnerability Root Cause Two factors combine to create this vulnerability: Factor 1: redirectUri is optional with an unsafe…
Recommended action: Upgrade to 2.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. Affected Component - File: src/serverroutes.ts - Endpoint: PUT /signalk/v1/api/sourcePriorities (also accessible at /skServer/sourcePriorities) - Lines: 1064-1076 - Function: Source priorities configuration handler Vulnerable Code Vulnerability Characteristics Missing Authentication: The endpoint has zero authentication middleware, allowing unauthenticated access from any network-adjacent attacker. Direct Configuration Assignment:…
Recommended action: Upgrade to 2.24.0-beta.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
According to SignalK's security documentation, when a server is first initialized without security enabled, the /skServer/enableSecurity endpoint is intentionally exposed to allow the owner to set up the initial admin account. This initial open access is by design. However, the critical vulnerability is that this route is never deregistered or disabled after the initial successful setup. Even after the genuine administrator has created their account, restarted the server, and activated token security, the /skServer/enableSecurity route remains perpetually open. Furthermore, the endpoint explicitly trusts the type field provided in the request body, passing it directly into the server's security configuration without validation. Because the route remains permanently listening, any unauthenticated user can call this endpoint at any time to silently inject a new, fully privileged admin account alongside the legitimate ones. Vulnerable Root Cause File: src/serverroutes.ts (Lines…
Recommended action: Upgrade to 2.24.0-beta.4 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The /signalk/v1/applicationData/... JSON-patch endpoint allows users to modify stored application data. To prevent Prototype Pollution, the developers implemented an isPrototypePollutionPath guard. However, this guard only checks the path property of incoming JSON-patch objects. It completely fails to check the from property. Because JSON-patch operations like copy and move extract data using the from property path, an attacker can construct a payload where from targets /proto/someProperty, completely evading the security check and successfully executing an Arbitrary Prototype Read. While this does not allow arbitrary code execution (as the destination path remains protected from proto), it does allow a user to exfiltrate internal Node functions and prototype state into their own application data. Vulnerability Root Cause File: src/interfaces/applicationData.js (Lines 48-57) At Line 201: Proof of Concept (PoC) Verify the Developer Guard Works (The Blocked Payload): Result:…
Recommended action: Upgrade to 2.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Path Traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory. Details Platform: Windows (Linux only allows traversal up a single directory) Authentication Required: Yes (ability to write depends on user's permission) The vulnerability exists in the validateAppId() function within the applicationData API handler. This function validates the appid parameter but only checks for forward slashes: Root Cause: - The validation only blocks / characters - On Windows, path.join() uses the platform's native path separator - Windows treats both / and \ as valid directory separators - Backslash-based traversal sequences like ..\..\.. pass…
Recommended action: Upgrade to 2.20.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SignalK Server exposes two features that can be chained together to steal JWT authentication tokens without any prior authentication. The attack combines WebSocket-based request enumeration with unauthenticated polling of access request status. Unauthenticated WebSocket Request Enumeration: When a WebSocket client connects to the SignalK stream endpoint with the serverevents=all query parameter, the server sends all cached server events including ACCESSREQUEST events that contain details about pending access requests. The startServerEvents function iterates over app.lastServerEvents and writes each cached event to any connected client without verifying authorization level. Since WebSocket connections are allowed for readonly users (which includes unauthenticated users when allowreadonly is true), attackers receive these events containing request IDs, client identifiers, descriptions, requested permissions, and IP addresses. Unauthenticated Token Polling: The access request status…
Recommended action: Upgrade to 2.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SignalK access request system has two related features that when combined by themselves and with the infromation disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: clientId, description, and permissions. The SignalK admin UI displays the description field prominently to the administrator when showing pending requests, but the actual permissions field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request admin permissions while providing a description that suggests readonly access. The access request handler trusts the X-Forwarded-For HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is…
Recommended action: Upgrade to 2.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SignalK appstore interface allows administrators to install npm packages through a REST API endpoint. While the endpoint validates that the package name exists in the npm registry as a known plugin or webapp, the version parameter accepts arbitrary npm version specifiers including URLs. npm supports installing packages from git repositories, GitHub shorthand syntax, and HTTP/HTTPS URLs pointing to tarballs. When npm installs a package, it can automatically execute any postinstall script defined in package.json, enabling arbitrary code execution. The vulnerability exists because npm's version specifier syntax is extremely flexible, and the SignalK code passes the version parameter directly to npm without sanitization. An attacker with admin access can install a package from an attacker-controlled source containing a malicious postinstall script. Affected Code File: src/interfaces/appstore.js (lines 46-76) File: src/modules.ts (lines 180-205) Impact An attacker with admin…
Recommended action: Upgrade to 2.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks. Summary An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Details The vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware's protection list in src/tokensecurity.js. Vulnerable Code Analysis: 1. Missing Protection: The tokensecurity.js file defines an array of paths that require authentication. However, the following paths defined in src/serverroutes.ts are missing from this list: - /skServer/serialports - /skServer/availablePaths - /skServer/hasAnalyzer 2. Unrestricted Access: Because they are missing from the protection…
Recommended action: Upgrade to 2.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Denial of Service (DoS) vulnerability allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (/signalk/v1/access/requests). This causes a "JavaScript heap out of memory" error due to unbounded in-memory storage of request objects. Details The vulnerability is caused by a lack of rate limiting and improper memory management for incoming access requests. Vulnerable Code Analysis: 1. In-Memory Storage: In src/requestResponse.js, requests are stored in a simple JavaScript object: 2. Unbounded Growth: The createRequest function adds new requests to this object without checking the current size or count of existing requests. 3. Infrequent Pruning: The pruneRequests function, which removes old requests, runs only once every 15 minutes (pruneIntervalRate). 4. No Rate Limiting: The endpoint /signalk/v1/access/requests accepts POST requests from any client without any rate limiting or authentication (by design, as it's for initial…
Recommended action: Upgrade to 2.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE). Details The vulnerability is caused by the use of a module-level global variable restoreFilePath in src/serverroutes.ts, which is shared across all requests. Vulnerable Code Analysis: 1. Global State: restoreFilePath is defined at the top level of the module. 2. Unauthenticated State Pollution: The /skServer/validateBackup endpoint updates this variable. Crucially, this endpoint lacks authentication middleware, allowing any user to access it. 3. Restore Hijacking: The /skServer/restore endpoint uses the polluted restoreFilePath to perform the restoration. Exploit Chain: 1. Pollution: Attacker uploads a malicious zip file…
Recommended action: Upgrade to 2.19.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.