https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:27:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318643 EUVD-2026-318643 https://cve.radiocsirt.org/vuln/euvd-2026-318643 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42281 <p>MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.</p> <p>MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42281 https://cve.radiocsirt.org/vuln/ghsa-ph6f-2cvq-79hq <p><strong>Affected:</strong> npm: magicmirror</p> <p>### Summary</p> <p>An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the `/cors` endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (`**VAR_NAME**`), enabling exfiltration of server-side secrets.</p> <p>### Details</p> <p>The `/cors` endpoint in `js/server_functions.js` (function `cors()`, lines 37-78) acts as an open HTTP proxy with no authentication and no URL validation. Any user-supplied URL is fetched server-side via `fetch()` and the full response is returned to the caller.</p> <p>Additionally, the `replaceSecretPlaceholder()` function (lines 21-25) expands any `**VARIABLE_NAME**` pattern in the URL with the corresponding `process.env` value before the request is made, allowing an attacker to exfiltrate environment variables (e.g. API keys, tokens, database credentials).</p> <p>**Vulnerable code path:**</p> <p>``` GET /cors?url=&lt;attacker-controlled-url&gt; → replaceSecretPlaceholder(url) // expands **ENV_VAR** → process.env.ENV_VAR → fetch(url) // no validation, no blocklist → response returned to attacker // full body, status, headers ```</p> <p>**Key issues:** - No authentication required - No URL validation or blocklist for private/reserved IP ranges - No restriction on URL scheme or destination - Environment variable expansion in URL before fetch</p> <p>### PoC</p> <p>**Prerequisites…</p> <p><strong>Affected:</strong> npm: magicmirror</p> <p>### Summary</p> <p>An unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the `/cors` endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (`**VAR_NAME**`), enabling exfiltration of server-side secrets.</p> <p>### Details</p> <p>The `/cors` endpoint in `js/server_functions.js` (function `cors()`, lines 37-78) acts as an open HTTP proxy with no authentication and no URL validation. Any user-supplied URL is fetched server-side via `fetch()` and the full response is returned to the caller.</p> <p>Additionally, the `replaceSecretPlaceholder()` function (lines 21-25) expands any `**VARIABLE_NAME**` pattern in the URL with the corresponding `process.env` value before the request is made, allowing an attacker to exfiltrate environment variables (e.g. API keys, tokens, database credentials).</p> <p>**Vulnerable code path:**</p> <p>``` GET /cors?url=&lt;attacker-controlled-url&gt; → replaceSecretPlaceholder(url) // expands **ENV_VAR** → process.env.ENV_VAR → fetch(url) // no validation, no blocklist → response returned to attacker // full body, status, headers ```</p> <p>**Key issues:** - No authentication required - No URL validation or blocklist for private/reserved IP ranges - No restriction on URL scheme or destination - Environment variable expansion in URL before fetch</p> <p>### PoC</p> <p>**Prerequisites…</p> https://cve.radiocsirt.org/vuln/ghsa-ph6f-2cvq-79hq