CVE-2026-63643: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63643 is a Server-Side Request Forgery (SSRF) vulnerability in MagicMirror², an open-source modular smart mirror platform. The flaw exists in the ADD_CALENDAR handler within modules/default/calendar/node_helper.js, which accepts attacker-controlled URLs and configuration via the unauthenticated Socket.IO namespace /calendar, enabling server-side requests without any SSRF validation. All versions prior to 2.37.0 are affected; the issue was disclosed on July 1, 2026, and published to the GitHub Advisory Database on August 18, 2026. It carries a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is a combination of CWE-918 (Server-Side Request Forgery) and CWE-441 (Unintended Proxy / Confused Deputy): the Socket.IO server is configured with a wildcard CORS policy (origin: /.*$/) and no authentication on the /calendar namespace, meaning any network-reachable client can emit the ADD_CALENDAR notification. The handler passes the attacker-supplied url, auth (including bearer token), and selfSignedCert fields directly to CalendarFetcher, which performs an outbound HTTP(S) request with no allowlist or SSRF guard. When the response is valid iCal, parsed event data is returned to the attacker via the CALENDAR_EVENTS event, enabling full response-body exfiltration; non-iCal responses still yield a blind SSRF with timing-based port-scanning capability. A public PoC (exploit-ssrf-calendar.js) was included in the advisory and demonstrates the full attack flow (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an unauthenticated attacker who can reach the MagicMirror HTTP port to force the server to make arbitrary outbound requests, potentially accessing cloud metadata endpoints (e.g., 169.254.169.254), localhost admin panels, or other internal network services unreachable from the attacker's network. When the internal service returns valid iCal data, the full response body is exfiltrated back to the attacker via CALENDAR_EVENTS. Additionally, the attacker can inject arbitrary Authorization: Bearer headers into the server-side request (credential injection / confused deputy), bypass TLS verification via selfSignedCert: true, and perform internal port scanning through error and timing differences (Github Advisory, GitHub Security Advisory).

A public PoC exploit (exploit-ssrf-calendar.js) was published as part of the security advisory, demonstrating unauthenticated exploitation requiring only network access to the MagicMirror HTTP port. The EPSS score is reported as 0.0, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. No threat actor attribution has been identified. The attack requires no privileges or user interaction, though the "Attack Requirements: Present" metric reflects the need for network reachability to the mirror's port (Github Advisory, GitHub Security Advisory).

1. Reconnaissance: Identify MagicMirror² instances (default port 8888) accessible from the attacker's network using tools like Shodan, Censys, or direct network scanning. Confirm the version is below 2.37.0.
2. Establish Socket.IO connection: Using socket.io-client, connect to the /calendar namespace on the target (e.g., http://TARGET:8888/calendar) — no authentication or credentials are required due to the wildcard CORS policy.
3. Emit ADD_CALENDAR with malicious payload: Send an ADD_CALENDAR notification with an attacker-controlled url pointing to an internal target (e.g., http://169.254.169.254/latest/meta-data/ or http://127.0.0.1:8080/admin), optionally including a forged auth.pass bearer token and setting selfSignedCert: true to bypass TLS validation:

   socket.emit("ADD_CALENDAR", {
     url: "http://169.254.169.254/latest/meta-data/",
     fetchInterval: 60000,
     auth: { method: "bearer", pass: "internal-admin-token" },
     selfSignedCert: true,
     id: "pwn"
   });

4. Receive exfiltrated data: If the internal service returns valid iCal content, the server parses it and emits CALENDAR_EVENTS back to the attacker's socket, containing the response body as parsed event data. Listen for this event to collect exfiltrated information.
5. Blind SSRF / port scanning: For non-iCal responses, observe CALENDAR_ERROR events and measure response timing to infer open/closed ports or service availability on the internal network (Github Advisory, GitHub Security Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the MagicMirror server to internal IP ranges (e.g., 127.0.0.1, 169.254.169.254, RFC-1918 addresses); outbound requests with Authorization: Bearer headers to internal endpoints; connections to external webhook/exfiltration services (e.g., webhook.site) originating from the MagicMirror process.
• Logs: Socket.IO connection logs showing /calendar namespace connections from unexpected or external IP addresses; CALENDAR_ERROR events logged in rapid succession (indicative of port scanning); server-side HTTP request logs showing fetches to internal or metadata URLs.
• Process: The MagicMirror Node.js process initiating outbound HTTP requests to unusual destinations, particularly to loopback or link-local addresses (127.0.0.1, 169.254.x.x).
• Application: Unexpected CALENDAR_EVENTS responses containing data not matching any configured calendar source; repeated ADD_CALENDAR socket emissions with varying URLs from the same client.

Upgrade MagicMirror² to version 2.37.0 or later, which enforces the existing ipWhitelist configuration on Socket.IO handshakes via a new socketIpAccessControl handler (PR #4169, commit 58c2a5e), closing the gap where the whitelist was only applied to HTTP routes. As an interim workaround for users unable to upgrade immediately, restrict network access to the MagicMirror HTTP port (default 8888) using firewall rules so that only trusted hosts can connect. Additionally, configure a non-empty ipWhitelist in config.js to limit which IPs may connect, though note this was not enforced for Socket.IO prior to 2.37.0 (MagicMirror Release, Fix PR).

The vulnerability was reported by security researcher gabrie0x6c and the fix was implemented by contributor KristjanESPERANTO, with the advisory published by the MagicMirror project maintainers. The fix was merged into the develop branch on June 1, 2026, and included in the v2.37.0 release on July 1, 2026. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory has been identified (Github Advisory, Fix PR).