Stored XSS in luci-app-https-dns-proxy resolver_url Parameter

Successful exploitation allows execution of arbitrary JavaScript in an administrator’s browser session within the application’s origin. This can enable session hijacking, unauthorized actions performed with the administrator’s privileges, access to sensitive administrative interface data, modification of configuration through the web UI, and potential establishment of further persistence or lateral administrative control within the managed device context.

Restrict access to authenticated configuration functions to trusted users only and minimize the number of accounts permitted to modify HTTPS DNS Proxy settings. Avoid allowing lower-privileged or semi-trusted users to supply resolver_url values until a fix is applied. Administrators should avoid viewing the affected status page if untrusted users may have modified configuration. Additional defensive measures include enforcing strong session protections, using browser-side controls such as Content Security Policy where feasible, and monitoring for unexpected configuration changes in the application.

Upgrade to a vendor-fixed version of luci-app-https-dns-proxy that properly escapes or sanitizes the resolver_url value before rendering it in the administrative interface. The vulnerable code path should be corrected so untrusted data is output using context-appropriate encoding and is never inserted into the DOM as raw HTML unless it has been strictly sanitized. Review existing stored resolver_url values and remove any malicious or unexpected content that may already be present.