Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magicmirror | npm | <= 2.35.0 | 2.36.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) located in the /cors endpoint of the MagicMirror application. The analysis of the provided security patches confirms that two functions in js/server_functions.js are responsible for the vulnerability.
The primary vulnerable function is cors, which handles requests to the /cors endpoint. The original, vulnerable implementation of this function took a URL from a query parameter and fetched its content without any validation. This allowed attackers to use the MagicMirror server as a proxy to make requests to internal network resources, cloud provider metadata services (like 169.254.169.254), and other sensitive endpoints not directly accessible to the attacker. The patches, starting with commit b1814f0e97cd1ddb47cb2ec1740ee91e395377d6, introduce IP address validation to block requests to private and reserved ranges, confirming the lack of such checks in the vulnerable code.
The second function, replaceSecretPlaceholder, exacerbates the SSRF vulnerability. This function was called by cors to substitute placeholders in the URL with environment variables from the server. An attacker could leverage this by crafting a URL that included a placeholder for a sensitive environment variable (e.g., **API_KEY**) and pointed to a server they control. The MagicMirror server would replace the placeholder with the secret value and send it to the attacker's server. The patch in commit c52ce23a5b66b01c651ef97a8ce0480c66473636 mitigates this by restricting secret replacement to specific, trusted configurations, highlighting that it was previously unrestricted.
During an exploit, a runtime profiler would show a call to the cors function, which in turn calls replaceSecretPlaceholder before making the outbound fetch request. Both functions are critical to the exploitation of this vulnerability.
