---
id: 9148
canonical_url: "https://phying.com/item/9148"
title: "[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)"
type: "vulnerability"
cve: "CVE-2026-63642, CVE-2026-63643"
cvss: null
severity: "high"
vendor: "MagicMirrorOrg"
product: "MagicMirror²"
affected_versions: "2.36.0"
source_domain: "yokai.hakaisecurity.io"
source_url: "https://yokai.hakaisecurity.io/pt-br-por-tras-do-espelho-investigando-vulnerabilidades-no-magicmirror2-cve-2026-63642-cve-2026-63643/"
published_at: "2026-10-01T19:57:45Z"
snapshot_at: "2026-10-26T05:55:00Z"
archived_by: "Phying News (https://phying.com/item/9148)"
lang: "en"
---

# Behind the Mirror: Investigating Vulnerabilities in MagicMirror² (CVE-2026-63642, CVE-2026-63643)

*Researcher: Gabriel Alves · Published: October 1, 2026 · Source: [yokai.hakaisecurity.io](https://yokai.hakaisecurity.io/pt-br-por-tras-do-espelho-investigando-vulnerabilidades-no-magicmirror2-cve-2026-63642-cve-2026-63643/)*

![MagicMirror Research Banner](https://yokai.hakaisecurity.io/content/images/size/w2000/2026/10/ARTIGO_MAGICMIRROR_GABRIEL1.png)

During source code analysis of **MagicMirror²**, an open-source platform used to transform semi-transparent mirrors into smart displays, the **Yokai team at Hakai Security** identified two Server-Side Request Forgery (SSRF) vulnerabilities: [CVE-2026-63642](https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g) and [CVE-2026-63643](https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j).

These flaws reside in different modules and allow externally controlled HTTP requests to be processed by the server:
- **CVE-2026-63642** affects the `newsfeed` module, allowing server-side `HEAD` requests via article URL verification (Blind SSRF).
- **CVE-2026-63643** affects the `calendar` module, allowing full SSRF where responses can be retrieved.

## What is MagicMirror²?

MagicMirror² is an open-source modular smart mirror platform that runs on Raspberry Pi and other systems to display time, weather, news headlines, and calendars.

Reference: [`MagicMirror²`](https://magicmirror.builders/)

![MagicMirror Display](https://yokai.hakaisecurity.io/content/images/2026/09/image-2.png)

## Vulnerability Details

### 1. Blind SSRF in `newsfeed` (CVE-2026-63642)

The `checkArticleUrl()` function in `defaultmodules/newsfeed/node_helper.js` performs an HTTP `HEAD` request to a user-provided URL without adequate destination validation:

```javascript
// defaultmodules/newsfeed/node_helper.js
checkArticleUrl: function (url) {
    // sends HEAD request to arbitrary url without restriction
}
```

Because the request uses `HEAD`, the response body is not returned to the client, constituting a **Blind SSRF**. Differences in response status and processing times can be leveraged to map internal networks and identify available internal services.

### 2. Full SSRF in `calendar` (CVE-2026-63643)

The `ADD_CALENDAR` Socket.IO handler in `modules/calendar/node_helper.js` forwards incoming payloads directly to the calendar fetcher component without validation or destination restriction.

Unlike the project's `/cors` endpoint (which contains destination validation controls), the `ADD_CALENDAR` handler lacks equivalent protection, allowing an attacker to coerce the server into fetching arbitrary internal resources and observing the returned contents through the calendar module workflow.

## Exploitation

### Exploiting Blind SSRF (CVE-2026-63642)

The PoC connects to the `/newsfeed` namespace over **Socket.IO** and emits the `CHECK_ARTICLE_URL` event with an attacker-controlled target URL. MagicMirror² processes the event and issues the HTTP `HEAD` request from the server.

Public Exploit: [Hakai Security CVE-2026-63642 Repository](https://github.com/hakaioffsec/CVE-2026-63642)

![Exploiting CVE-2026-63642](https://blog.hackingclub.com/content/images/2026/09/image-1.png)

### Exploiting SSRF (CVE-2026-63643)

The PoC connects to the `/calendar` namespace over **Socket.IO** and sends the `ADD_CALENDAR` event containing the target internal URL. The server issues the request and returns the fetched content, enabling access to internal endpoints and cloud metadata services.

![Exploiting CVE-2026-63643](https://blog.hackingclub.com/content/images/2026/09/image-3.png)

## Responsible Disclosure

Both vulnerabilities were identified by Gabriel Alves (Yokai Research / Hakai Security) and reported via GitHub Security Advisories:
- **CVE-2026-63642**: Blind SSRF in `newsfeed` module (Affects version 2.36.0, fixed in 2.37.0+)
- **CVE-2026-63643**: Full SSRF in `calendar` module (Affects version 2.36.0, fixed in 2.37.0+)

## Implemented Fixes

The vulnerabilities were resolved in commit [`58c2a5e`](https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e) and released in **v2.37.0**.

The fix implements an access control mechanism for **Socket.IO** connections, enforcing the server's `ipWhitelist` configuration on WebSocket connections.

In `js/ip_access_control.js`, `socketIpAccessControl()` verifies the client IP during the Socket.IO handshake:

```javascript
function socketIpAccessControl(whitelist) {
    return (req, callback) => {
        // enforce whitelist on socket.io requests
    };
}
```

In `js/server.js`:

```javascript
allowRequest: socketIpAccessControl(config.ipWhitelist),
```

This prevents unauthorized remote clients from connecting to the `Socket.IO` namespaces used by `newsfeed` and `calendar`.

Modified files:
- [`js/ip_access_control.js` lines 90–107](https://github.com/MagicMirrorOrg/MagicMirror/blob/58c2a5e/js/ip_access_control.js#L90-L107)
- [`js/server.js` line 44](https://github.com/MagicMirrorOrg/MagicMirror/blob/58c2a5e/js/server.js#L44)

## Mitigation

1. **Upgrade**: Update MagicMirror² to version **2.37.0** or later.
2. **Access Control**: Restrict MagicMirror² network interfaces to trusted local networks. Do not expose the application directly to the public internet.
3. **Whitelist Configuration**: Review `ipWhitelist` in `config/config.js` to ensure only legitimate local clients are permitted.

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/9148) · Original source: [yokai.hakaisecurity.io](https://yokai.hakaisecurity.io/pt-br-por-tras-do-espelho-investigando-vulnerabilidades-no-magicmirror2-cve-2026-63642-cve-2026-63643/)