/
← Voltar ao feed
medium

SSRF flaws CVE-2026-63642 and CVE-2026-63643 in MagicMirror² newsfeed and calendar modules, fixed in 2.37.0

1 fonte(s) · 1 atualização(ões) · publicado 01/10/2026 16:57 · coletado há 4 dias

The Yokai Research Team at Hakai Security disclosed two Server-Side Request Forgery (SSRF) vulnerabilities in MagicMirror², an open-source smart mirror platform: CVE-2026-63642 (blind SSRF in the newsfeed module) and CVE-2026-63643 (SSRF in the calendar module). Both let a client make the MagicMirror² server send HTTP requests to attacker-chosen destinations, which can expose internal services that are not reachable from the Internet. Version 2.36.0 is affected, and the issues are fixed in 2.37.0 or later. Public proof-of-concept exploits are available in the Hakai Security GitHub repository. The article does not report exploitation in the wild.

Detalhes técnicos

  • CVE-2026-63642: the checkArticleUrl() function in newsfeed/node_helper.js sends an HTTP HEAD request to a user-supplied URL without validating the destination. No response body is returned, so this is blind SSRF. Differences in responses and timing can reveal which internal services exist.
  • CVE-2026-63643: the ADD_CALENDAR handler in calendar/node_helper.js passes the received payload straight to the calendar fetcher without restricting the destination URL. The content returned by the destination can be retrieved through the calendar module's event flow, so this is full-response SSRF. The project's /cors endpoint already has protections that this handler lacks.
  • Both are exploited over Socket.IO: CHECK_ARTICLE_URL on the /newsfeed namespace and ADD_CALENDAR on the /calendar namespace.
  • Fix commit 58c2a5e adds socketIpAccessControl() in js/ip_access_control.js, used through allowRequest in js/server.js. Socket.IO connections now respect the ipWhitelist configuration.

Remediação

  • Update MagicMirror² to 2.37.0 or later.
  • If patching is not immediately possible, restrict access to the interface to trusted users and networks and avoid exposing it directly to the Internet.
  • Review the ipWhitelist configuration and limit the server's access to sensitive internal services.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 01/10/2026 16:57 · coletado 19/10 18:03 primeiro registro

    SSRF flaws CVE-2026-63642 and CVE-2026-63643 in MagicMirror² newsfeed and calendar modules, fixed in 2.37.0

    ler a análise desta fonte

    The Yokai Research Team at Hakai Security disclosed two Server-Side Request Forgery (SSRF) vulnerabilities in MagicMirror², an open-source smart mirror platform: CVE-2026-63642 (blind SSRF in the newsfeed module) and CVE-2026-63643 (SSRF in the calendar module). Both let a client make the MagicMirror² server send HTTP requests to attacker-chosen destinations, which can expose internal services that are not reachable from the Internet. Version 2.36.0 is affected, and the issues are fixed in 2.37.0 or later. Public proof-of-concept exploits are available in the Hakai Security GitHub repository. The article does not report exploitation in the wild.

    Technical Details

    • CVE-2026-63642: the checkArticleUrl() function in newsfeed/node_helper.js sends an HTTP HEAD request to a user-supplied URL without validating the destination. No response body is returned, so this is blind SSRF. Differences in responses and timing can reveal which internal services exist.
    • CVE-2026-63643: the ADD_CALENDAR handler in calendar/node_helper.js passes the received payload straight to the calendar fetcher without restricting the destination URL. The content returned by the destination can be retrieved through the calendar module's event flow, so this is full-response SSRF. The project's /cors endpoint already has protections that this handler lacks.
    • Both are exploited over Socket.IO: CHECK_ARTICLE_URL on the /newsfeed namespace and ADD_CALENDAR on the /calendar namespace.
    • Fix commit 58c2a5e adds socketIpAccessControl() in js/ip_access_control.js, used through allowRequest in js/server.js. Socket.IO connections now respect the ipWhitelist configuration.

    Remediation

    • Update MagicMirror² to 2.37.0 or later.
    • If patching is not immediately possible, restrict access to the interface to trusted users and networks and avoid exposing it directly to the Internet.
    • Review the ipWhitelist configuration and limit the server's access to sensitive internal services.