GHSA-p8gp-2w28-mhwg

Описание

Summary

A Command Injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages.

Details

Product: Signal K set-system-time plugin
Repository: https://github.com/SignalK/set-system-time

File: index.js, lines 60-71

The vulnerability has three components:

1. Unsanitized Input: The datetime value from navigation.datetime Signal K path is directly interpolated into a shell command without validation
2. Shell Execution: The command is executed via spawn('sh', ['-c', command]), which interprets shell metacharacters
3. Sudo Privileges: The plugin can execute with root privileges if sudo is misconfigured, instructions to limit passwordless sudo to the /bin/date binary helps mitigate this but RCE can still be achieved with the privileges of the user that installed it.

PoC

Exploitation Requirements

• Signal K server with security enabled, if disabled credentials not required
• Valid user credentials with readwrite or admin permissions
• set-system-time plugin installed and enabled
• Signal K server installed on a Linux OS
• Passwordless sudo configured, official instructions will do this for the date command which is enough to satisfy the if condition

Impact

An attacker that has write privileges either through security on the Signal K server being disabled or valid credentials with read/write permissions can execute arbitrary commands on the server with the privileges of the SignalK process or root if sudo is misconfigured. This enables complete system compromise.

Recommendations

• Replace shell-based execution with child_process.execFile() so user-controlled input is passed as arguments rather than interpreted by a shell.

• Validate that navigation.datetime conforms to an expected ISO-8601 format to improve robustness.