Executive brief
MagicMirror², a popular open-source smart mirror platform, contains a security flaw in its CORS proxy component. An attacker can use this flaw to force the mirror to access private internal network services or steal sensitive configuration data like API keys and credentials. This could lead to a full compromise of the device or the cloud environment where it is hosted.
Technical details
An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the `/cors` endpoint of MagicMirror² within `js/server_functions.js`. The endpoint acts as an open proxy, fetching any user-provided URL via `fetch()` without validation or restriction of IP ranges (e.g., localhost or cloud metadata services). Furthermore, the `replaceSecretPlaceholder()` function automatically expands `**VAR_NAME**` patterns in the requested URL with server-side environment variables, allowing for the exfiltration of secrets like API keys. Attackers can exploit this to scan internal networks, access cloud instance metadata (IMDSv1), or leak credentials. The issue is fixed in version 2.36.0.
Affected products
- MagicMirrorOrg MagicMirror² <= 2.35.0
Timeline
- 2026-04-30: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched: Fixed in version 2.36.0