MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADD_CALENDAR (MagicMirror² calendar)

** Analysis of the PoC exploit-ssrf-calendar.js.

Target: calendar/node_helper.js of MagicMirror², socket.io namespace /calendar.

Identification

Field Value

PoC file exploit-ssrf-calendar.js

Endpoint socket.io namespace /calendar, notification ADD_CALENDAR

Precondition reach the mirror's HTTP port (no authentication required)

Description

The ADD_CALENDAR handler in calendar/node_helper.js performs a server-side HTTP request to a URL that is fully attacker-controlled, with no SSRF protection whatsoever — unlike the project's hardened /cors endpoint.

Worse, the attacker also controls:

• the authentication headers the server attaches to the request (auth: { method: "bearer", pass: "..." });

• the selfSignedCert flag, which disables TLS verification of the server-side request.

When the target's response is valid iCal, the server parses the events and sends them back to the attacker via CALENDAR_EVENTS — turning the SSRF into full data exfiltration (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don't see the body).

Root cause: unauthenticated socket.io channel + permissive CORS

The socket.io server accepts connections from any origin and with no authentication:

const io = new Server(server, {
  cors: { origin: /.*$/, credentials: true }
});