CVE-2025-66459
📋 TL;DR
Lookyloo versions before 1.35.3 contain a cross-site scripting (XSS) vulnerability where malicious HTML in submitted URLs can execute arbitrary JavaScript in error messages when captures fail. This affects all users of vulnerable Lookyloo instances, particularly those accepting user-submitted URLs.
💻 Affected Systems
- Lookyloo
📦 What is this software?
Lookyloo by Lookyloo
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or compromise user accounts through client-side attacks.
Likely Case
Session hijacking, credential theft, or defacement of the Lookyloo interface through injected malicious scripts.
If Mitigated
Limited to UI manipulation within the Lookyloo interface if proper input validation and output encoding are implemented.
🎯 Exploit Status
Exploitation requires user interaction to submit malicious URLs, but no authentication is needed to trigger the XSS.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.35.3
Vendor Advisory: https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-hvmh-j2jx-48wg
Restart Required: Yes
Instructions:
1. Update Lookyloo to version 1.35.3 or later using pip: 'pip install lookyloo>=1.35.3' 2. Restart the Lookyloo service 3. Verify the update completed successfully
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject URLs containing HTML tags or script elements
Implement regex filter: /[<>]/ in URL validation logic
Output Encoding
allApply HTML entity encoding to error messages before displaying to users
Use appropriate HTML encoding functions in your framework
🧯 If You Can't Patch
- Disable user-submitted URL functionality or restrict to trusted sources only
- Implement a web application firewall (WAF) with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check Lookyloo version: 'pip show lookyloo' or examine package metadata. If version < 1.35.3, system is vulnerable.Check Version:
pip show lookyloo | grep VersionVerify Fix Applied:
After updating, test by submitting a URL with HTML elements that should fail capture. Verify error messages display encoded HTML entities instead of raw HTML.📡 Detection & Monitoring
Log Indicators:
- Unusual error messages containing HTML tags in Lookyloo logs
- Multiple failed capture attempts with similar payloads
Network Indicators:
- HTTP requests containing HTML/script tags in URL parameters to Lookyloo endpoints
SIEM Query:
source="lookyloo.log" AND ("<script" OR "<img" OR "onerror=" OR "javascript:")🔗 References
- https://github.com/Lookyloo/lookyloo/commit/1850a34b8cec52438df3b544295b20cfa35f8ad1
- https://github.com/Lookyloo/lookyloo/commit/8c3ab96de44c1ce15646d734aa06faf884329116
- https://github.com/Lookyloo/lookyloo/commit/95cdc00fe37fd89790fa89bb3ee3fefa2da38442
- https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-hvmh-j2jx-48wg
