MagicMirror² before version 2.37.0 has an SSRF vulnerability (CWE-918) in the ADD_CALENDAR handler located in defaultmodules/calendar/node_helper.js. The handler accepts attacker-controlled input including URLs, authentication credentials, and a selfSignedCert flag through an unauthenticated Socket.IO namespace (/calendar). These inputs are passed to CalendarFetcher without SSRF validation, enabling server-side requests to arbitrary URLs and optionally disabling TLS verification. If the response is a valid iCal calendar, parsed event data is returned to the attacker, allowing exfiltration of internal service data. Other responses still provide a blind request and timing side channel. The vulnerability is fixed in version 2.37.0.

An attacker can induce the MagicMirror server to make arbitrary HTTP requests, potentially accessing internal services not otherwise reachable externally. When the response is a valid iCal calendar, event data is parsed and returned to the attacker, enabling data exfiltration. Even if the response is not valid iCal, the attacker can still gain information through blind request and timing side channels. This can lead to unauthorized disclosure of internal network information and data.

Upgrade MagicMirror to version 2.37.0 or later, where this SSRF vulnerability is fixed. No other official remediation or temporary fix is documented. Until upgraded, restrict access to the Socket.IO /calendar namespace to trusted users or networks to reduce exposure.