Executive brief
MagicMirror is a Node.js application that displays information on smart mirrors. The application applies IP address filtering only to its HTTP routes, but not to its Socket.IO real-time communication server. In deployments where MagicMirror is exposed to a network (rather than loopback only), an attacker can bypass IP filtering by connecting directly to Socket.IO and sending arbitrary commands to module helpers, leading to server-side requests to internal services and potentially arbitrary command execution.
Technical details
The vulnerability is a trust-boundary bypass where Socket.IO module namespaces lack the same IP-based access control applied to Express HTTP routes. MagicMirror configures Socket.IO with overly permissive CORS (origin: /.*$/) and attaches it to the raw HTTP server before Express middleware is registered (js/server.js:42–50). The ipAccessControl middleware protecting Express routes (js/server.js:89–90) does not apply to Socket.IO handshakes or namespace connections. Once connected, an attacker can send arbitrary notifications to any module's socketNotificationReceived handler without authentication. Default modules expose multiple impacts: the newsfeed module accepts CHECK_ARTICLE_URL and performs server-side HEAD requests to attacker-supplied URLs (SSRF); the updatenotification module accepts CONFIG notifications containing update commands and executes them via child_process.exec when a third-party module is considered behind. The vulnerability requires network reachability to the Socket.IO port (non-loopback binding) but not authentication, and the RCE variant requires a pending third-party module update but the command source is attacker-controlled through the unauthenticated socket path.
Affected products
- MagicMirrorOrg MagicMirror < 2.37.0
Timeline
- 2026-07-01: disclosed
- 2026-08-18: advisory
- 2026: patched: Patched version 2.37.0 available