CVE-2025-56563: Zenith Satellite Tracker SSRF Vulnerability

CVE-2025-56563 Overview

CVE-2025-56563 is a Server-Side Request Forgery (SSRF) vulnerability in sat_proxy.php within Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it directly to curl_setopt(CURLOPT_URL) without validating the host or scheme. An unauthenticated remote attacker can force the server to issue arbitrary HTTP and HTTPS requests to internal networks or cloud metadata endpoints. Successful exploitation can expose sensitive internal resources, leak cloud instance credentials, and enable pivoting into further attacks against protected infrastructure.

Critical Impact
Unauthenticated attackers can coerce the server into making arbitrary HTTP/HTTPS requests, reaching internal services and cloud metadata APIs such as http://169.254.169.254/.

Affected Products

Zenith Satellite Tracker 1.0
sat_proxy.php component
Deployments exposing the proxy script to untrusted clients

Discovery Timeline

2026-09-16 - CVE-2025-56563 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2025-56563

Vulnerability Analysis

The vulnerability resides in sat_proxy.php, a server-side proxy script shipped with Zenith Satellite Tracker 1.0. The script reads the address parameter from the request and hands it directly to libcurl through curl_setopt(CURLOPT_URL). No validation is performed on the scheme, host, or destination network. Because the request is issued from the server context, it bypasses perimeter firewalls and originates from a trusted internal source address.

This pattern maps to Server-Side Request Forgery [CWE-918]. Attackers can request URLs targeting 127.0.0.1, RFC1918 ranges, container orchestration endpoints, or cloud provider metadata services. On AWS, Azure, and GCP instances, this exposure can leak temporary credentials and access tokens tied to the instance role.

Root Cause

The root cause is missing input validation on a user-controlled URL passed to an outbound HTTP client. The script trusts the address parameter without enforcing an allowlist of hosts, restricting schemes to http/https for public targets, or blocking link-local and private IP ranges. There is also no authentication in front of the proxy endpoint.

Attack Vector

The attack is remote, unauthenticated, and executed with a single HTTP request. An attacker sends a request such as GET /sat_proxy.php?address=http://169.254.169.254/latest/meta-data/ to retrieve cloud metadata, or targets internal services like http://127.0.0.1:8080/ to probe adjacent applications. The server returns the fetched content in the HTTP response, giving the attacker direct visibility into internal resources. See the GitHub Security Advisory for CVE-2025-56563 for additional technical detail.

Detection Methods for CVE-2025-56563

Indicators of Compromise

Web server access logs containing requests to sat_proxy.php with address parameters pointing to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Requests to sat_proxy.php referencing cloud metadata endpoints such as 169.254.169.254, metadata.google.internal, or 100.100.100.200.
Outbound connections from the web server process to link-local addresses that do not match normal application behavior.
Unusual schemes (file://, gopher://, dict://) supplied to the address parameter.

Detection Strategies

Deploy a web application firewall rule that blocks or alerts on address parameter values matching private, loopback, or link-local ranges.
Correlate web server request logs with egress netflow to identify sessions where inbound requests to sat_proxy.php precede outbound traffic to sensitive internal endpoints.
Hunt for anomalous User-Agent strings and response sizes on sat_proxy.php that deviate from legitimate satellite data lookups.

Monitoring Recommendations

Enable verbose access logging on the web server hosting Zenith Satellite Tracker and forward logs to a centralized analytics platform.
Instrument egress firewalls to log and alert on traffic from the web tier to 169.254.169.254 and other metadata services.
Baseline normal outbound destinations for the web server and alert on new destinations, particularly internal RFC1918 hosts.

How to Mitigate CVE-2025-56563

Immediate Actions Required

Remove or disable sat_proxy.php if the proxy functionality is not required in the deployment.
Restrict network egress from the web server so it cannot reach cloud metadata endpoints or internal management interfaces.
Place the application behind authentication and rate limiting to reduce unauthenticated attack surface.
Enforce IMDSv2 on AWS instances to require session tokens for metadata access.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult the GitHub Security Advisory for CVE-2025-56563 for updates and remediation guidance from the reporting researchers.

Workarounds

Modify sat_proxy.php to validate the address parameter against an allowlist of permitted hostnames and to reject schemes other than http and https.
Resolve the target hostname before issuing the request and reject any address that resolves to loopback, link-local, or RFC1918 ranges.
Front the endpoint with a reverse proxy that inspects and constrains outbound URLs before forwarding them to the application.

bash

# Example nginx snippet to block private-range targets in the address parameter
location = /sat_proxy.php {
    if ($arg_address ~* "(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|169\.254\.)") {
        return 403;
    }
    if ($arg_address !~* "^https?://") {
        return 403;
    }
    proxy_pass http://backend;
}