Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2.33.0
- Public exploit
- None on Exploit-DB
Summary
Signal K Server, an open-source marine data server, is affected by this flaw, which lets unauthenticated remote attackers download log archives and extract the JWT secret key. With that key, attackers can forge administrator tokens and create persistent admin accounts, gaining full control of the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.
Affected versions
- SignalK signalk-server
fixed in 2.33.0