Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-rate-limit (default: 100 attempts per 10-minute window, configurable via HTTP_RATE_LIMITS). The WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting.
An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been patched in version 2.25.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Signalk Signal_K_Server
cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*
|
— |
2.25.0
|
References 4
https://github.com/SignalK/signalk-server/commit/215d81eb700d5419c3396a0fbf23f2…
security-advisories@github.com
https://github.com/SignalK/signalk-server/pull/2568
security-advisories@github.com
https://github.com/SignalK/signalk-server/releases/tag/v2.25.0
security-advisories@github.com
https://github.com/SignalK/signalk-server/security/advisories/GHSA-vmfm-ch9h-5c…
security-advisories@github.com