-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the improper authentication configuration within src/tokensecurity.js. Several API endpoints that expose sensitive system information were not included in the list of paths requiring authentication. The analysis of the patch ead2a03d8994969cafcca0320abee16f0e66e7a9 confirms that the remediation involves adding the missing paths (/skServer/serialports, /skServer/availablePaths, /skServer/hasAnalyzer) to the authentication middleware's protection list. When these unprotected endpoints are accessed, the corresponding route handlers defined in src/serverroutes.ts are executed. These handlers, and the functions they subsequently call, are the sources of the information disclosure. Specifically, listAllSerialPorts reveals connected hardware, StreamBundle.getAvailablePaths exposes the entire data schema, and an anonymous handler for /skServer/hasAnalyzer checks for the presence of system tools. These functions would appear in a runtime profile during the exploitation of this vulnerability.
listAllSerialPortssrc/serverroutes.ts
StreamBundle.getAvailablePathssrc/serverroutes.ts
(anonymous function)src/serverroutes.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| signalk-server | npm | < 2.19.0 | 2.19.0 |
A Semantic Attack on Google Gemini - Read the Latest Research