CyberRota Analysis
AI-GeneratedThe vulnerability affects the MagicMirror² platform prior to version 2.37.0, where the checkArticleUrl function in the newsfeed module allows unauthenticated access to an attacker-controlled URL via Socket.IO. This can lead to information disclosure through a timing oracle, potentially revealing internal hosts and services that respond to HEAD requests. Organizations using affected versions should prioritize updating to version 2.37.0 to mitigate the risk of unauthorized access and information leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0.