Executive brief
MagicMirror is a popular open-source smart mirror platform that displays news feeds and other information. The newsfeed module contains an unauthenticated Socket.IO endpoint that accepts arbitrary URLs and performs server-side HEAD requests without validation. An attacker on the network can exploit this to scan internal hosts and ports, potentially discovering and probing internal services on the private network behind the mirror.
Technical details
The vulnerability exists in newsfeed/node_helper.js, where the checkArticleUrl() function performs fetch(url, { method: "HEAD" }) on attacker-supplied URLs without validation. The Socket.IO server is configured with permissive CORS (origin: /.*$/) and no authentication checks on the /newsfeed namespace, allowing any network-adjacent client to emit CHECK_ARTICLE_URL notifications. Although the server-side request uses HEAD (limiting body exposure), the combination of response timing, HTTP status codes, and error patterns provides a boolean oracle to determine whether internal hosts and services are alive. An attacker can systematically probe RFC1918 addresses and common service ports to map the internal network topology and discover running services. The vulnerability requires only network access to the mirror's HTTP port; no authentication is required. Patch: upgrade to version 2.37.0 or later, which validates URLs and restricts access to the endpoint.
Affected products
- MagicMirrorOrg MagicMirror < 2.37.0
Timeline
- 2026-07-01: disclosed
- 2026-08-18: advisory
- 2026-08-18: patched: Version 2.37.0 released with fix