MagicMirror² v2.36.0 Blind SSRF Vulnerability in CHECK_ARTICLE_URL with PoC

Vulnerability Overview Vulnerability Name: Blind SSRF via CHECK_ARTICLE_URL (MagicMirror² newsfeed) Vulnerability Description: The vulnerability exists in the namespace of MagicMirror², specifically within the function. This function uses the method to send an HTTP HEAD request but does not sufficiently validate the URL. An attacker can leverage this vulnerability to perform a blind SSRF attack, detecting the presence of internal hosts and ports by observing differences in response times. Scope of Impact Affected Version: MagicMirror² v2.36.0 Fixed Version: >= 2.37.0 Severity: Medium-High Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: None User Interaction: None Confidentiality Impact: None Integrity Impact: None Availability Impact: None Remediation Upgrade Version: Upgrade to MagicMirror² v2.37.0 or higher. POC Code Exploitation Code Impact Internal Network Scanning/Port Scanning: The presence, absence, and response time reveal which internal hosts and ports are active. Forced Server-Side Requests to Internal Services: The HEAD request reaches the target, as shown in the logs referenced in the PoC. Even though it is a HEAD request (no body), it serves as a reconnaissance primitive and trigger to cause side effects on endpoints that respond to GET/HEAD. References CWE-918: Server-Side Request Forgery (SSRF) CWE-306: Missing Authentication for Critical Function CWE-942: Permissive Cross-domain Policy with Untrusted Domains OWASP: SSRF Prevention Cheat Sheet Additional Information CVE ID: CVE-2026-6362 CVSS v4 Base Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None - Subsequent System Impact Metrics: - Confidentiality: Low - Integrity: Low - Availability: Low Credits: gabrielevec Precondition: Access to the mirror's HTTP port is required (no authentication required). Root Cause: Unauthenticated socket.io channel + permissive CORS policy. Description: - The function in executes without sufficiently validating the URL and returns ( , ). - This allows the attacker to use a boolean-time Oracle to map internal hosts and ports: presence, absence, and response times reveal which internal services are active. This is a "blind" SSRF—the attacker cannot see the body but forces a server-side request and observes the impact on the target. - Actual evidence was observed server-side (server-side HEAD requests appeared in the internal service logs) because the field leaked very little information. Identification: - PoC File: - Endpoint: , notification - Class: CWE-918 (Server-Side Request Forgery) - Severity: Medium-High - Precondition: Access to the mirror's HTTP port is required (no authentication required). Vulnerable Target Code (Pattern): Impact: - Internal Network Scanning/Port Scanning: The presence, absence, and response time reveal which internal hosts and ports are active. - Forced Server-Side Requests to Internal Services: The HEAD request reaches the target, as shown in the logs referenced in the PoC. - Even though it is a HEAD request (no body), it serves as a reconnaissance primitive and trigger to cause side effects on endpoints that respond to GET/HEAD. References: - CWE-918: Server-Side Request Forgery (SSRF) - CWE-306: Missing Authentication for Critical Function - CWE-942: Permissive Cross-domain Policy with Untrusted Domains - OWASP: SSRF Prevention Cheat Sheet Disclaimer: This PoC and report are intended solely for authorized security testing/research in a controlled laboratory environment.

Goal Reached Thanks to every supporter — we hit 100%!

MagicMirror² v2.36.0 Blind SSRF Vulnerability in CHECK_ARTICLE_URL with PoC

More from this source