Signal K resources API path traversal → JWT secret leak & RCE (GHSA-4xm8-rg9h-jhq2)
Severity: critical · Patch status: patched · Since 2026-10-30
A path traversal flaw in the Signal K v2 resources API (GET /signalk/v2/api/resources/:resourceType/:resourceId) passes an unvalidated resourceId to FileStore.getResource(), letting %2F-encoded traversal sequences read, write and delete arbitrary files outside the storage root. On deployments with allowreadonly=true an unauthenticated attacker can read <config/security.json, disclosing the plaintext JWT signing secret and password hashes, forge an admin JWT, and add an Execute provider that spawns arbitrary shell commands — yielding persistent RCE with server privileges. On default deployments any readonly user token suffices. All signalk-server =2.0.0 <2.34.0 and @signalk/resources-provider =1.0.0 <1.5.3 are affected. Fixes released in signalk-server 2.34.0 and @signalk/resources-provider 1.5.3 (commit 83689f0). A public PoC exists; no in-the-wild exploitation reported.
What to do
- Upgrade signalk-server to 2.34.0+ and @signalk/resources-provider to 1.5.3+ immediately
- If upgrading is not possible, disable allow_readonly and restrict network access to the server
- Rotate the JWT signing secret and all user credentials, assuming security.json may have been read
- Audit settings.json and configured providers for unexpected Execute entries and remove them
- Review logs for traversal patterns (..%2F) against the resources API and for forged admin tokens
Fixed versions
- signalk-server 2.34.0
- @signalk/resources-provider 1.5.3
Sources
All live incidents on Threat Watch
