-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| signalk-server | npm | < 2.19.0 | 2.19.0 |
Miggo AIRoot Cause AnalysisThe vulnerability in Signal K Server (CVE-2025-68620) allows an unauthenticated attacker to steal JWT authentication tokens, leading to a full authentication bypass. The attack chains two distinct vulnerabilities:
WebSocket Event Enumeration: An attacker can connect to the WebSocket stream endpoint (/signalk/v1/stream) with the serverevents=all parameter. The startEvents function in src/events.ts would process this request without proper authentication checks. Subsequently, the startServerEvents function would send all cached server events to the attacker's WebSocket client. The vulnerability lies in the sendAccessRequestsUpdate function in src/tokensecurity.js, which, prior to the patch, would emit sensitive ACCESS_REQUEST events (containing request IDs of legitimate users) as a generic serverevent. This event was broadcast to all clients, including the unauthenticated attacker. The patch mitigates this by introducing a new serverAdminEvent and ensuring that sendAccessRequestsUpdate uses this new event type, which is only dispatched to authenticated administrators.
Unauthenticated Token Polling: After obtaining a valid access request ID from the WebSocket stream, the attacker can poll the corresponding REST API endpoint (/signalk/v1/access/requests/:id). This endpoint is configured with read-only authentication, which allows unauthenticated access when allow_readonly is enabled. When an administrator approves the access request, the createReply function in src/requestResponse.js constructs the response. Critically, if the request is approved, this function includes the newly generated JWT token in plain text within the JSON response. The attacker, by continuously polling the endpoint, receives this token and can use it to impersonate the legitimate user or device, gaining their privileges.
The combination of these two flaws allows an attacker with no prior access to gain privileged access to the server. The identified vulnerable functions are the key components that enable this attack chain, from the initial information disclosure via WebSockets to the final token theft via the REST API.
startEventssrc/events.ts
startServerEventssrc/events.ts
sendAccessRequestsUpdatesrc/tokensecurity.js
createReplysrc/requestResponse.js