CVE-2025-56563: Zenith Zenith Satellite Tracker vulnerability
A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetopt(CURLOPTURL) without host or scheme validation. An unauthenticated remote attacker can leverage this to make arbitrary HTTP and HTTPS requests from the server to internal networks or cloud metadata services, potentially obtaining sensitive information or pivoting to further attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by supplying a controlled URL to the address parameter accepted by sat_proxy.php. No account or prior access is described as necessary.
What systems or services could be exposed through the vulnerable server?
The vulnerable server can be induced to make HTTP or HTTPS requests to internal network resources and cloud metadata services. This may expose sensitive information available to the server or enable further pivoting from the server's network position.
What input validation is missing?
The address URL parameter is passed to curl_setopt using CURLOPT_URL without validation of the destination host or URL scheme. As described, this permits attacker-directed HTTP and HTTPS requests from the server.