MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handler passes these fields to CalendarFetcher, causing a server-side request without SSRF validation and optionally disabling TLS verification. When the response is valid iCal, CALENDAR_EVENTS returns parsed event data to the attacker, allowing internal-service response data to be exfiltrated; other responses still provide a blind request and timing primitive. This issue is fixed in version 2.37.0.

Affected: npm: magicmirror

# Vulnerability — SSRF via `ADD_CALENDAR` (MagicMirror² calendar)

> Analysis of the PoC `exploit-ssrf-calendar.js`. > Target: `calendar/node_helper.js` of MagicMirror², socket.io namespace `/calendar`.

---

## Identification

| Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-calendar.js` | | **Endpoint** | socket.io namespace `/calendar`, notification `ADD_CALENDAR` | | **Precondition** | reach the mirror's HTTP port (no authentication required) |

---

## Description

The `ADD_CALENDAR` handler in `calendar/node_helper.js` performs a **server-side** HTTP request to a URL that is **fully attacker-controlled**, with no SSRF protection whatsoever — unlike the project's hardened `/cors` endpoint.

Worse, the attacker also controls: - the **authentication headers** the server attaches to the request (`auth: { method: "bearer", pass: "..." }`); - the `selfSignedCert` flag, which **disables TLS verification** of the server-side request.

When the target's response is **valid iCal**, the server parses the events and sends them back to the attacker via `CALENDAR_EVENTS` — turning the SSRF into **full data exfiltration** (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don't see the body).

---

## Root cause: unauthenticated socket.io channel + permissive CORS

The socket.io server accepts connections from **any origin** and with **no authentication**:

```js const io = new Serve…