SignalK signalk-server versions before 2.28.0 contain an SSRF vulnerability (CWE-918) due to insufficient validation of host, port, useTLS, and selfsignedcert parameters in the makeRemoteRequest() function. When security is disabled, the addAdminMiddleware() function is a no-op, leaving the testSignalKConnection, requestAccess, and checkAccessRequest endpoints accessible without authentication. This allows attackers to coerce the server into making arbitrary network requests, including to loopback, private, link-local, cloud metadata, or external hosts. The vulnerability also enables internal port scanning via distinct response behaviors, exfiltration of internal service data, and execution of server-side POST requests with attacker-controlled JSON. The checkAccessRequest endpoint's interpolation of requestId into the destination path allows path traversal on the target host. These combined factors can facilitate reconnaissance, data leakage, and lateral movement within the affected environment. The vulnerability is resolved in version 2.28.0.

An attacker can exploit this SSRF vulnerability to make the signalk-server initiate network requests to arbitrary internal or external destinations, potentially bypassing security controls. This can lead to internal port scanning, exfiltration of sensitive data from cloud metadata and internal services, and unauthorized POST requests with attacker-controlled payloads. The vulnerability also enables path traversal on the destination host, increasing the risk of data exposure. These impacts can facilitate further attacks such as lateral movement within a cluster or environment. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact.

This vulnerability is fixed in SignalK signalk-server version 2.28.0. Users should upgrade to version 2.28.0 or later to remediate this issue. Until the upgrade is applied, configuring security to enable authentication and validation on the affected endpoints can reduce exposure. Patch status is confirmed fixed in 2.28.0.