Summary
luci-app-https-dns-proxy contains a stored cross-site scripting flaw in the resolver_url field, where untrusted input is later rendered as raw HTML.
An authenticated user can inject active content that executes in an administrator's browser when they view the HTTPS DNS Proxy status page, potentially leading to actions in the admin's session.
Affected context
This vulnerability appears in the web interface of luci-app-https-dns-proxy where resolver configuration values are displayed back to users.
It becomes relevant in deployments where multiple authenticated users can configure or influence the resolver_url parameter and administrators regularly inspect the HTTPS DNS Proxy status page.
The issue relies on the UI rendering stored configuration values without encoding or sanitization in a browser context.
Exploit preconditions
- Attack surface: Web-based administrative interface of luci-app-https-dns-proxy
- Required access: Authenticated access sufficient to set or modify the resolver_url parameter
- Trigger point: An administrator viewing the HTTPS DNS Proxy status page where the stored resolver_url is displayed
- Why exploitation is possible: The resolver_url value is stored and subsequently inserted into the page without proper output encoding or HTML/JavaScript sanitization, allowing injected scripts to run in the administrator's browser origin
Why this happens
The root cause is a classic stored cross-site scripting pattern where user-controlled data is persisted and then reflected into an HTML response without appropriate context-aware escaping.
In this case, the resolver_url parameter is treated as display-safe and rendered directly into the DOM, violating output encoding best practices.
This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, where untrusted input is embedded in a web page and interpreted as script rather than inert data.
Potential impact
- An attacker-controlled script may execute with the administrator's browser privileges
- The script could perform actions on behalf of the administrator within the web UI
- Session or CSRF-protected actions could be triggered indirectly
- Malicious content injection could mislead administrators or alter displayed status data
General mitigation guidance
Effective mitigation centers on treating all user-supplied or configuration-driven values as untrusted at render time.
Common patterns include:
- Applying strict, context-aware output encoding for all dynamic values inserted into HTML, attributes, or JavaScript
- Normalizing resolver URLs to a safe, expected format and rejecting inputs that contain markup or script-like constructs
- Rendering untrusted values in text-only contexts (e.g., using HTML escaping or dedicated display components) rather than as raw HTML
- Minimizing the privileges and actions exposed through the web UI to limit impact if a script runs
How teams detect issues like this
Detection typically focuses on identifying unencoded or unsanitized data flows into the UI:
- Static analysis rules that flag templating or rendering paths where variables are injected into HTML without encoding
- Code review checklists that require explicit escaping for configuration or user-derived fields such as resolver_url
- Security testing and fuzzing that injects benign script markers into configuration fields to observe whether they execute in the browser
- Use of automated linters or CI policies that enforce safe templating practices in web views
