Signal K Server Restore State Pollution RCE

This repository is a real exploit repository for CVE-2025-66398 targeting Signal K Server 2.18.0 and earlier. It is not tied to a larger exploit framework. The repo contains two primary exploit implementations, one in Go (cve-2025-66398.go) and one in Python (cve-2025-66398.py), plus an Nmap NSE detection script (http-signalk-cve-2025-66398.nse) and a Docker lab environment for local testing. The main exploit logic, as described in both Go and Python sources, targets an unauthenticated Signal K backup/configuration workflow and chains state pollution/config hijacking into remote code execution. The exploit’s stated impact is unauthenticated injection of a backdoor admin account followed by RCE. The code supports both interactive and non-interactive operation. Command-line options indicate the full capability set: vulnerability checking, backdoor username/password injection, optional use of admin credentials for restore/cleanup phases, arbitrary command execution, remote file read, remote file write, raw Node.js code injection into the security module, and reverse shell deployment with attacker-supplied lhost/lport. The exploit is operational rather than a simple PoC because it includes concrete post-exploitation actions and reusable payload paths, but it is not obviously weaponized as a framework module. It uses HTTP(S) requests with TLS verification disabled, normalizes a user-supplied target URL, and authenticates against /signalk/v1/auth/login after planting or using credentials. The code contains OS-aware logic for Linux and Windows targets, including different tokensecurity module paths, shell binaries, and file read/write command generation. The Nmap NSE script is separate and safe: it is a detection-only script, not an exploit. It checks /signalk/v1/ for version information and sends a benign multipart POST to /skServer/validateBackup with an empty security.json ZIP to determine whether the backup endpoint is accessible without authentication. It explicitly avoids exploitation or state modification. The Docker directory provides a lab environment to reproduce or test the issue. It builds a Node-based container with Signal K Server 2.18.0, exposes port 3000 internally and maps it to host port 9360, and seeds settings.json and security.json into /home/signalk/.signalk. The lab config sets the security strategy to ./tokensecurity and includes a predefined admin user in security.json, which helps demonstrate the vulnerable configuration model. Overall, the repository’s purpose is to demonstrate and operationalize exploitation of a Signal K Server unauthenticated backup/configuration flaw leading to account injection and RCE, while also providing a scanner/checker and a reproducible Docker lab.

Repository provides a dual-implementation (Go and Python) exploit/PoC for CVE-2025-66398 affecting Signal K Server <= 2.18.0. The exploit chain is described as: (1) unauthenticated state pollution by uploading a crafted .backup to /skServer/validateBackup, (2) config hijacking by triggering /skServer/restore (requires admin auth token obtained via POST /signalk/v1/auth/login, or relies on the injected backdoor admin), and (3) optional RCE by switching the Signal K security strategy to an attacker-controlled Node.js module (directory name cve-2025-66398-rce) so that after restore+restart the server loads malicious code. Both implementations support interactive guided exploitation and non-interactive flags for: vulnerability check (-check), command execution (-command), remote file read (-read-file using cat/type), remote file write (-write-file via base64 decode on linux or PowerShell WriteAllBytes on windows), raw Node.js code injection (-code), and reverse shell deployment (-shell with -lhost/-lport; spawns /bin/sh -i on linux or cmd.exe on windows). The code disables TLS verification (InsecureSkipVerify / requests verify=False) and uses a distinctive User-Agent containing the GitHub URL. Structure: main exploit logic lives in cve-2025-66398.go and cve-2025-66398.py; README.md documents phases, flags, and examples; docker/ contains a reproducible vulnerable lab (Signal K Server 2.18.0) with docker-compose exposing host port 9360 to container 3000 and preseeded settings/security JSON; GitHub Actions workflow builds cross-platform Go binaries on release. Overall purpose is an operational PoC demonstrating unauthenticated state pollution leading to backdoor admin creation and potential RCE via malicious security module loading.