CVE-2026-53983 in Ground Station
Summary
by MITRE • 08/07/2026
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability exists within the ground-station software version 0.6.0 and earlier, representing a critical blind server-side request forgery flaw that undermines the system's security posture through multiple exploitable vectors. The attack surface is widened by the absence of authentication enforcement on the Socket.IO server listening on port 7000, which operates with a wildcard CORS policy allowing unrestricted client connections. This configuration permits any unauthenticated user to establish a connection and manipulate the system's orbital source configuration path. The vulnerability stems from the application's failure to validate or sanitize URLs submitted through the data_submission event with submit-orbital-sources action, creating an entry point for malicious URL persistence in the database.
The technical implementation of this flaw involves multiple components working in concert to enable persistent SSRF attacks. When an attacker submits a malicious URL through the data_submission event, it gets stored without any scheme validation or host restrictions, including the absence of checks against loopback addresses, RFC1918 private ranges, or cloud instance metadata endpoints such as 169.254.169.254. These stored URLs are then processed by the _fetch_http_3le and _fetch_http_omm functions in backend/tlesync/source_adapters.py where they are passed directly to requests.get without any sanitization or validation. The vulnerability is further exacerbated by the fact that HTTP status codes and error messages from these outbound requests are broadcast to all connected Socket.IO clients through the orbital_sync_state event, providing attackers with an oracle for interpreting responses from internal services or cloud metadata endpoints.
The operational impact of this vulnerability extends far beyond a simple one-time attack vector due to the persistence mechanisms built into the system. The malicious URLs remain stored in the database across application restarts and automatically re-execute every 24 hours through the scheduled background_task:start event, creating a durable long-term SSRF capability. This persistent nature transforms what would otherwise be a transient vulnerability into a sustained threat that does not require continuous attacker presence or connection maintenance. The attack provides an effective means for reconnaissance and information leakage, as attackers can infer internal network topology and service availability through HTTP status codes and error messages without direct response body exposure.
The mitigation strategy should focus on implementing comprehensive input validation and sanitization mechanisms at multiple layers of the application stack. All external URLs submitted to the orbital-source configuration must undergo strict scheme whitelisting, host validation, and IP address range filtering that blocks loopback, private, and metadata service addresses. The Socket.IO server requires authentication enforcement and specific CORS policy restrictions to prevent unauthorized connections from arbitrary clients. The system should implement network-level restrictions preventing outbound requests to internal services or cloud metadata endpoints, combined with proper input sanitization in the _fetch_http_3le and _fetch_http_omm functions that validate all URLs before making HTTP requests. This vulnerability aligns with CWE-918 Server-Side Request Forgery and maps to ATT&CK technique T1071.004 Application Layer Protocol: DNS, demonstrating how improper input validation can enable persistent reconnaissance and lateral movement capabilities within networked systems.
The architectural flaw represents a fundamental security oversight in the application's design pattern for handling external data sources, where trust is placed in user-submitted data without proper validation mechanisms. This vulnerability exemplifies how insufficient security controls at multiple layers can compound to create serious threats, particularly when authentication is disabled and CORS policies are overly permissive. The persistent nature of the vulnerability through scheduled background tasks demonstrates how simple input validation failures can result in long-term security implications that extend well beyond immediate exploitation windows. The system's reliance on unauthenticated Socket.IO communication for configuration management creates a dangerous attack surface that could enable more sophisticated attacks if combined with other vulnerabilities or access vectors.