Executive brief
Zenith Satellite Tracker is a web application for tracking satellite data. The application contains an unauthenticated endpoint that allows attackers to make the server send HTTP/HTTPS requests to any location, including internal systems or cloud services, to retrieve sensitive information or pivot to further attacks without requiring any user authentication or authorization.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in api/sat_proxy.php due to unsanitized user input passed directly to curl_setopt(CURLOPT_URL). The vulnerable code accepts an attacker-controlled 'address' parameter via GET request and constructs a URL without validation of scheme, host, resolved IP address, or port. The endpoint neither enforces an allowlist of permitted upstream hosts nor blocks private/loopback address ranges. An unauthenticated remote attacker can abuse this to make arbitrary HTTP(S) requests from the server to internal networks or cloud metadata services (e.g., AWS/Azure/GCP metadata endpoints), potentially exfiltrating secrets, API keys, or configuration data. No patch has been released; remediation is in progress.
Affected products
- Zenith Tracker Satellite Tracker 1.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory