Listen to this Post
This Cross-Site Scripting (XSS) vulnerability in Lookyloo arises from unsafe rendering of user-controlled data within web pages. Lookyloo’s web interface uses f-strings in Markup templates to dynamically generate HTML content without proper sanitization. When Lookyloo captures a website page, it processes JSON documents from third-party servers to display a tree of interacting domains. A malicious server can craft a JSON response containing JavaScript code within script elements. This JSON is then parsed and incorporated into the Lookyloo interface using f-strings in Markup. The f-strings directly embed untrusted input into the HTML output without escaping. Consequently, the JavaScript code from the malicious JSON is treated as executable script by the victim’s browser. The attack occurs when a user views a captured page in Lookyloo that fetched data from a compromised server. The vulnerability is client-side, requiring the user to interact with the Lookyloo instance. The injected script runs in the context of the Lookyloo domain, allowing session hijacking. Attackers could steal cookies, authentication tokens, or perform actions on behalf of the user. The exploit relies on the server-side code not validating or sanitizing the JSON content before rendering. Specifically, the use of `Markup(f”…”)` with user input leads to XSS. Versions prior to 1.35.3 are affected because they lack input sanitization for these f-strings. The fix in version 1.35.3 involves proper escaping or avoidance of f-strings in Markup for untrusted data. This prevents the injection of malicious script elements into the DOM. The vulnerability is classified as medium severity due to the need for user interaction and a malicious server. It impacts the confidentiality and integrity of the user’s session within Lookyloo. The attack vector is network-based, with low attack complexity and no privileges required. User interaction is necessary as the victim must view the captured page. The scope is changed, affecting security controls within Lookyloo’s interface.
Platform: Lookyloo
Version: Prior to 1.35.3
Vulnerability: XSS
Severity: MEDIUM
date: 12/02/2025
Prediction: Fixed in 1.35.3
What Undercode Say:
Analytics
Check Lookyloo version
python3 -c “import lookyloo; print(lookyloo.__version__)”
Run Lookyloo instance
lookyloo –host 0.0.0.0 –port 8080
Curl to test JSON response simulation
curl -X POST http://localhost:8080/capture -H “Content-Type: application/json” -d ‘{“url”:”http://malicious-site.com”}’
How Exploit:
Craft malicious JSON with script payload. Host on server. Lure user to capture site via Lookyloo. Serve JSON with JS. Execute steal cookies.
Protection from this CVE
Update to 1.35.3. Sanitize all inputs. Escape f-strings. Use secure Markup.
Impact:
Session hijacking. Data theft. Unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
