Executive brief
MagicMirror is a smart display platform used to show calendars and other information on mirror screens. An unauthenticated attacker with network access to the mirror's HTTP port can force the server to make arbitrary HTTP requests to internal or external targets, including cloud metadata services and private network hosts. When calendar responses are returned in iCalendar format, the attacker can read the full response body, enabling data theft from services not directly accessible to the attacker.
Technical details
The calendar module in MagicMirror accepts a socket.io notification called `ADD_CALENDAR` without authentication, allowing any browser or process reaching the mirror's port to trigger it. The handler passes an attacker-controlled URL, authentication headers, and a `selfSignedCert` flag directly to a calendar fetcher that makes a server-side HTTP request. The socket.io server is configured with permissive CORS (`origin: /.*$/`) and no connection-level authentication (CWE-306, CWE-918). If the server's response is valid iCalendar format, events are parsed and sent back to the attacker via `CALENDAR_EVENTS`, enabling full response body exfiltration. The attacker can also inject arbitrary `Authorization: Bearer` headers (confused deputy attack) and disable TLS certificate verification. The vulnerability affects versions before 2.37.0 and is reachable over the network if the mirror's HTTP port is accessible.
Affected products
- MagicMirror Organization MagicMirror < 2.37.0
Timeline
- 2026-08-18: disclosed: GitHub advisory published
- 2026-07-01: patched: Fix released in version 2.37.0