Vulnerability Overview (At a Glance)

CVE ID: CVE-2025-66398
Product: Signal K Server
Affected Versions: All versions prior to 2.19.0
Fixed Version: 2.19.0
Vulnerability Class: Improper Access Control, State Manipulation, Arbitrary File Overwrite
Attack Vector: Network
Authentication Required: None
User Interaction: None (admin action only triggers final stage)

Severity & Scoring

CVSS v3.1 Base Score: 9.8 (Critical)

Impact Breakdown

Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Exploitability Breakdown

Attack Complexity: Low
Privileges Required: None
Scope: Changed

This vulnerability represents a worst-case scenario: unauthenticated exploitation with full system compromise.

Exploit Availability & Maturity

Exploitation is trivial and reproducible using basic HTTP clients
No race conditions or environment-specific requirements
No authentication or session handling required
Highly reliable across deployments
Actively discussed and reproducible in private security circles

This flaw is fully weaponizable and suitable for automation.

Vulnerability Description

Signal K Server exposes an internal endpoint used for validating backup files:

POST /skServer/validateBackup

This endpoint is designed to inspect backup metadata before restoration. However, in vulnerable versions:

The endpoint does not enforce authentication
User-supplied input is trusted
Internal application state is modified directly
No validation is applied to file paths

The endpoint writes attacker-controlled input into an internal server variable:

restoreFilePath

This variable is later reused by the administrator-initiated Restore Backup workflow without revalidation.

This results in a state pollution vulnerability that allows delayed exploitation.

Root Cause Analysis

The core issues are:

Missing authentication on a sensitive internal endpoint
Failure to validate or sanitize file paths
Reuse of mutable internal state across trust boundaries
Separation between attacker action and final impact (logic flaw)

This combination allows an attacker to prepare the exploit silently and wait for an administrator to unknowingly trigger it.

Exploitation Flow

Step 1 – Initial Access

An attacker sends a crafted POST request to:

/skServer/validateBackup

No authentication headers, cookies, or tokens are required.

Step 2 – Internal State Poisoning

The request payload includes a malicious file path, for example:

../../security.json

/home/signalk/.signalk/package.json

This value is stored internally as restoreFilePath.

Step 3 – Persistence Without Visibility

No file is modified at this stage
No error is generated
No alert is triggered
The poisoned state remains active in memory

Step 4 – Administrator Trigger

A legitimate administrator later performs a Restore Backup operation through the UI.

The server:

Trusts the existing restoreFilePath
Skips validation
Writes restore data to the attacker-supplied location

Step 5 – Arbitrary File Overwrite

Critical files are overwritten, including:

security.json – authentication, users, roles
package.json – dependencies and startup scripts
Other configuration or application files

Step 6 – Post-Exploitation Outcomes

Account Takeover

Replace admin credentials
Create hidden admin users
Disable authentication controls

Remote Code Execution

Inject malicious npm lifecycle scripts
Execute arbitrary code on service restart
Achieve persistent execution

Why This Vulnerability Is Critical in Practice

Signal K Server is often deployed:

On embedded or marine systems
With elevated permissions
On trusted internal networks
Without continuous monitoring

Overwriting package.json enables automatic code execution on restart, while overwriting security.json enables permanent access.

This turns a single unauthenticated request into a persistent, stealthy compromise.

MITRE ATT&CK Mapping

Initial Access

Exploit Public-Facing Application

Privilege Escalation

Abuse of trusted restore functionality

Defense Evasion

Delayed execution through state poisoning

Persistence

Malicious configuration and startup scripts

Impact

System integrity compromise
Service takeover

Indicators of Compromise

Network Indicators

Requests to /skServer/validateBackup from non-admin IPs
Repeated access attempts to the endpoint
Payloads containing path traversal patterns

Host Indicators

Unexpected changes to security.json or package.json
Node.js or npm execution after restore events
Modified startup scripts

Example Exploit Payloads

{
  "backupPath": "../../security.json"
}

{
  "backupPath": "/home/signalk/.signalk/package.json"
}

Detection Strategy Overview

Effective detection requires correlation between:

Network activity
File integrity changes
Process execution

Without all three, exploitation may go unnoticed.

SIEM Detection Rules

Required Log Sources

Application & Network

Signal K Server application logs
Web server or reverse proxy access logs

Host & OS

Linux audit logs
File Integrity Monitoring
Process execution logs
Service restart logs

Splunk Detection Rules

1. Suspicious Access to Vulnerable Endpoint

index=web OR index=signalk
uri_path="/skServer/validateBackup"
| stats count by src_ip, http_method, user_agent
| where count > 1

2. Path Traversal Payload Detection

index=web OR index=signalk
"/skServer/validateBackup"
(".." OR "../" OR "..\\" OR "security.json" OR "package.json" OR "/etc/")
| table _time src_ip uri payload

3. Critical Configuration File Modification

index=os OR index=audit
(file_path="*security.json" OR file_path="*package.json")
(action="modified" OR action="created")
| table _time host user process_name file_path

4. Malicious Node.js Execution

index=os
(process_name="node" OR process_name="npm")
(command_line="*preinstall*" OR command_line="*postinstall*" OR command_line="*scripts*")
| table _time host user command_line

Microsoft Sentinel Detection Rules (KQL)

1. Endpoint Exploitation Attempt

AppRequests
| where Url contains "/skServer/validateBackup"
| summarize Count=count() by ClientIP, UserAgent
| where Count > 1

2. Path Traversal Detection

AppRequests
| where Url contains "/skServer/validateBackup"
| where RequestBody has_any ("../", "..\\", "security.json", "package.json", "/etc/")
| project TimeGenerated, ClientIP, RequestBody

3. File Integrity Violation

DeviceFileEvents
| where FileName in ("security.json", "package.json")
| where ActionType in ("FileModified", "FileCreated")
| project TimeGenerated, DeviceName, InitiatingProcessFileName

4. Suspicious npm / node Execution

DeviceProcessEvents
| where FileName in ("node", "npm")
| where ProcessCommandLine has_any ("preinstall", "postinstall", "scripts")
| project TimeGenerated, DeviceName, ProcessCommandLine

High-Confidence Correlation Rule

Trigger a Critical Alert if the following occur within a short time window:

Access to /skServer/validateBackup
Modification of security.json or package.json
Node or npm execution shortly after

This combination strongly indicates successful exploitation.

Incident Response Guidance

Immediate actions upon detection:

Isolate the affected system
Stop Signal K Server service
Preserve modified files for forensic analysis
Rotate all credentials
Reinstall dependencies
Validate startup scripts

Remediation

Required Fix

Upgrade to Signal K Server version 2.19.0 or later

https://github.com/SignalK/signalk-server/releases/tag/v2.19.0

The patch:

Enforces authentication on backup validation
Prevents unsafe internal state modification
Validates restore file paths

Additional Hardening

Restrict access to administrative endpoints
Enable file integrity monitoring
Run the service with least privilege
Monitor all restore operations

Final Assessment

CVE-2025-66398 is a critical, easily exploitable vulnerability that enables unauthenticated attackers to silently prepare a full system takeover. The delayed execution model makes it especially dangerous, as compromise may occur long after the initial attack.

Any Signal K Server deployment running versions below 2.19.0 should be considered at immediate risk until patched and validated.

CVE-2025-66398: Critical Signal K Server Flaw Enables Unauthenticated Full System Takeover