Efstratios Goudelis Ground Station up to 0.5.x Orbital Sync source_adapters.py _fetch_http_3le/_fetch_http_omm server-side request forgery

Summaryinfo

A vulnerability was found in Efstratios Goudelis Ground Station up to 0.5.x and classified as critical. This impacts the function _fetch_http_3le/_fetch_http_omm of the file backend/tlesync/source_adapters.py of the component Orbital Sync. Executing a manipulation can lead to server-side request forgery. The identification of this vulnerability is CVE-2026-53983. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in Efstratios Goudelis Ground Station up to 0.5.x and classified as critical. This vulnerability affects the function _fetch_http_3le/_fetch_http_omm of the file backend/tlesync/source_adapters.py of the component Orbital Sync. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-53983 since 06/11/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 0.6.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Efstratios Goudelis

Name

• Ground Station

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion