signalk-server: Unauthenticated Source Priorities Manipulation

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.1, the SignalK Server exposes an unauthenticated HTTP endpoint that allows remote attackers to modify navigation data source priorities. This endpoint, accessible via PUT /signalk/v1/api/sourcePriorities, does not enforce authentication or authorization checks and directly assigns user-controlled input to the server configuration. As a result, attackers can influence which GPS, AIS, or other sensor data sources are trusted by the system. The changes are immediately applied and persisted to disk, allowing the manipulation to survive server restarts. This issue has been patched in version 2.24.0-beta.1.

N/A

访问控制不恰当

Signal K Server 访问控制错误漏洞

Signal K Server是Signal K开源的一个船用中央服务器。 Signal K Server 2.24.0-beta.1之前版本存在访问控制错误漏洞，该漏洞源于未经验证的端点允许修改数据源优先级，可能导致导航数据被操纵。

N/A

N/A