MagicMirror² is an open source smart mirror platform. In versions before 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts unvalidated attacker-controlled URLs, authentication data, and selfSignedCert settings through the unauthenticated Socket.IO namespace /calendar. These inputs are passed to CalendarFetcher, which performs server-side requests without SSRF validation and can optionally disable TLS verification. If the response is a valid iCal calendar, parsed event data is returned to the attacker, enabling exfiltration of internal service data. Other responses still provide a blind request and timing side-channel. The vulnerability is addressed in version 2.37.0.

An unauthenticated attacker can cause the MagicMirror server to make arbitrary HTTP requests to internal or external services, potentially bypassing network restrictions. Valid iCal responses allow the attacker to exfiltrate internal service data. Even invalid responses provide a blind request and timing information, which could be leveraged for further attacks. This can lead to information disclosure and reconnaissance within internal networks.

Upgrade MagicMirror to version 2.37.0 or later, where this SSRF vulnerability is fixed. No other mitigation is indicated by the vendor advisory.