Threats affecting pkg:npm/signalk-server

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.

SignalK Server versions prior to 2.25.0 are vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) attack. The vulnerability arises from the WebSocket subscription handling logic where unescaped regex metacharacters in the 'context' parameter can trigger catastrophic backtracking in the Node.js event loop. This causes the server CPU to spike to 100%, resulting in a complete denial of service. The issue is fixed in version 2.25.0.