## https://sploitus.com/exploit?id=AB52C65C-61B5-5467-9449-496A92020833
# SSRF in MagicMirror² Calendar Module
A proof-of-concept exploit for CVE-2026-63642 and CVE-2026-63643, Server-Side Request Forgery vulnerabilities in MagicMirror²'s Calendar module that allow any unauthenticated attacker to force the server to make arbitrary HTTP requests to internal services.
Install:
```bash
$ npm init -y
$ npm install socket.io-client
```
Usage:
```bash
# CVE-2026-63642 - Basic SSRF
$ node cve-2026-63642.js
# CVE-2026-63643 - SSRF with TLS bypass and iCal exfiltration
$ node cve-2026-63643.js
```
## Vulnerable Versions
- MagicMirror² ≤ 2.36.0
## Root Cause
The `/calendar` Socket.IO namespace accepts an `ADD_CALENDAR` event with a user-controlled `url` parameter. The server fetches this URL without validation, allowing requests to internal services:
```javascript
socket.emit("ADD_CALENDAR", { url: "http://internal-service/" });
```
CVE-2026-63643 extends this with `selfSignedCert: true` to bypass TLS verification and exfiltrate iCal content from internal calendars.
## Affected Endpoints
- Socket.IO `/calendar` namespace → `ADD_CALENDAR` event
## Impact
CWE-918 Server-Side Request Forgery. Any unauthenticated attacker can:
- **Access internal services** cloud metadata, Redis, internal APIs
- **Bypass firewall/ACLs** server makes requests from trusted network
- **Exfiltrate internal calendars** via iCal parsing with `selfSignedCert` bypass
- **Port scan** internal network through timing differences
## CVSS
**7.5 High** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
# Disclaimer
This tool is for educational and research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this program.
# QuimeraX Intelligence
QuimeraX Intelligence is an advanced EASM and Cyber Threat Intelligence platform specializing in identifying critical vulnerabilities in complex systems. The platform proactively monitors, detects, and alerts clients about security threats, ensuring transparency and rapid response to potential risks. Clients receive immediate notifications and comprehensive reports if their systems are found vulnerable, enabling them to take protective action. [learn more](https://hakaisecurity.io/quimera-team/)
# Hakai Security
[Hakai Security](https://hakaisecurity.io/) is a cybersecurity company founded by security professionals, committed to technical excellence. We offer tailored security solutions including advanced penetration testing, realistic Red Team simulations, and secure development practices to proactively protect our clients' assets from evolving cyber threats.
# Hacking Club
[Hacking Club](https://hackingclub.com/) is the training platform where you learn cybersecurity through hands-on lessons, labs, and challenges created by experts working in our security consulting firm: straight from the battlefield to your training.