Vulnerability feed

Executive summary

Signal K Server versions from 2.28.0-beta.2 before 2.34.0 contain a server-side request forgery flaw in the App Store icon fetcher, which trusts absolute icon URLs supplied by plugin authors. The advisory does not state a severity rating or a CVSS score. The fix is described in the advisory's code changes, and the advisory does not state a separate vendor recommendation beyond the fixed version range.

Technical summary

The flaw is classified as server-side request forgery (CWE class not stated) in the App Store icon fetcher, which accepted absolute signalk.appIcon URLs from plugin package.json files. The attack precondition is a plugin author supplying a hostile or internal-network URL, and the advisory does not state the required privileges or user interaction. Affected versions are from 2.28.0-beta.2 before 2.34.0, and a fixed version is not separately stated beyond the 2.34.0 boundary. The changes add a CDN-only fetch check with manual redirect handling, ignore absolute appIcon URLs, and add tests; no workaround is stated. The advisory does not state whether the flaw has been exploited in the wild, and it gives no detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/SignalK/signalk-server/commi…5252da397948e5101dc6

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

Present

Privileges required

None

User interaction

Passive

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

Signal KSignal K signalk-server