Delegated Stored XSS in OpenWrt luci-app-https-dns-proxy resolver_url

luci-app-https-dns-proxy: delegated resolver_url stored XSS Vulnerability Overview CVE ID: GHSA-c6vf-395q-4jv6 Severity: Medium (4.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None Description: An authenticated LuCI/UCI user with access limited to can store active HTML within the value of the configuration. When an administrator opens the HTTPS DNS Proxy status page, LuCI reads the runtime command line from the command, derives the display name from the resolver URL, injects it as HTML, and executes JavaScript within the administrator's LuCI context. This is a delegated ACL stored XSS crossing privilege boundaries. The proof of concept does not require generic access or generic access. Impact Scope Affected Components: - LuCI Package: - Backend Package: - Test Firmware: OpenWrt 25.12.8-rc1 r32555-9e80e6539c c86-84 - Test Packages: , - Patched Versions: Unknown Remediation Recommended Fixes: - Do not render the resolver URL or provider-derived name as raw HTML. Use DOM/text nodes when building the service instance status, or HTML-escape the display name, address, and port values. Only allow trusted static elements such as and . - Add deep validation in the backend path, accepting only valid resolver URL syntax. This validation should not replace output encoding in LuCI. - Add regression tests with custom resolver URLs such as , asserting that the HTTPS DNS Proxy status page displays the value as text without creating an executable DOM. POC Code Evidence Screenshot !Evidence screenshot Impact Successful exploitation allows JavaScript execution within an administrator session when viewing the HTTPS DNS Proxy overview/status page. The proof of concept only used a visible alert payload.

Goal Reached Thanks to every supporter — we hit 100%!

Delegated Stored XSS in OpenWrt luci-app-https-dns-proxy resolver_url

More from this source