CVE-2026-63642 in MagicMirror
Summary
by MITRE • 08/18/2026
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in MagicMirror² prior to version 2.37.0 represents a critical server-side request forgery flaw rooted in the absence of input validation for URL parameters within the newsfeed module's backend logic. Specifically, the checkArticleUrl function located in defaultmodules/newsfeed/node_helper.js exposes an unauthenticated Socket.IO namespace at /newsfeed that accepts the CHECK_ARTICLE_URL notification from any connected client without requiring authentication or authorization checks. When this notification is received, the application executes a fetch operation using the HTTP HEAD method on the provided URL string. This design flaw allows remote attackers to supply arbitrary URLs, effectively turning the MagicMirror² instance into an open proxy capable of initiating network requests to internal and external resources based solely on attacker-controlled input.
From a technical perspective, this vulnerability facilitates both Server-Side Request Forgery (SSRF) and blind SSRF scenarios where the application acts as a pivot point for network reconnaissance. By leveraging the response data returned by the fetch operation, specifically the ARTICLE_URL_STATUS which includes framing results and timing information, an attacker can construct precise timing oracles. These oracles allow the determination of whether specific internal hosts are reachable and if particular ports are open and responding to HEAD requests. This capability significantly lowers the barrier for network mapping within protected environments, as the attacker does not need direct access to the target services but rather relies on the side effects generated by the MagicMirror² server's interaction with those services.
The operational impact of this vulnerability extends beyond simple information disclosure. The ability to trigger HEAD requests against internal services can lead to unintended consequences in systems that react specifically to such methods, potentially causing denial-of-service conditions or triggering state-changing operations if misconfigured endpoints exist. Furthermore, the exposure of internal network topology aids attackers in identifying vulnerable targets for subsequent exploitation phases. This aligns with Common Weakness Enumeration (CWE) categories including CWE-918 Server-Side Request Forgery and CWE-20 Improper Input Validation. In terms of attack patterns, this behavior maps to MITRE ATT&CK techniques such as T1571 Non-Standard Port for Communication or T1046 Network Service Discovery, depending on the specific internal services targeted.
To mitigate this vulnerability, organizations running MagicMirror² must immediately upgrade to version 2.37.0 or later, where the developers have implemented proper validation mechanisms for URLs passed through the Socket.IO namespace. In environments where upgrading is not immediately feasible, network-level controls should be enforced to restrict outbound HTTP traffic from the server hosting MagicMirror², particularly preventing access to internal IP ranges and non-standard ports unless explicitly required by business logic. Additionally, implementing strict input sanitization that whitelists allowed domains or protocols can provide a defensive layer against similar flaws in other modules. It is also recommended to review Socket.IO configurations to ensure that sensitive namespaces are not exposed without appropriate authentication middleware, thereby reducing the attack surface for unauthenticated interactions with backend helper functions.