CVE-2026-67352: luci-app-https-dns-proxy XSS Vulnerability

CVE-2026-67352 Overview

CVE-2026-67352 is a stored cross-site scripting (XSS) vulnerability in luci-app-https-dns-proxy, a LuCI web interface component for OpenWrt that manages HTTPS DNS proxy configuration. The flaw resides in the resolver_url parameter, which fails to sanitize user input before rendering it on the HTTPS DNS Proxy status page. Authenticated users can inject active HTML that executes JavaScript in the administrator's browser origin when the status page is viewed. The issue is tracked under [CWE-79] and disclosed in the GitHub Security Advisory.

Critical Impact
An authenticated attacker on an adjacent network can inject JavaScript that runs with administrator privileges in the LuCI web interface, enabling session takeover and configuration tampering.

Affected Products

OpenWrt luci-app-https-dns-proxy
LuCI web interface for OpenWrt
OpenWrt routers deploying the HTTPS DNS Proxy component

Discovery Timeline

2026-08-01 - CVE-2026-67352 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67352

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the LuCI application that manages the HTTPS DNS Proxy service on OpenWrt. LuCI accepts a resolver_url value from an authenticated user through the configuration interface and persists it to the underlying UCI configuration. When an administrator later opens the HTTPS DNS Proxy status page, the stored resolver_url is emitted into the HTML document without proper output encoding.

Because the value is rendered as raw HTML, any script tags or event-handler attributes embedded in the resolver URL execute in the browser context of the LuCI administrator. The attacker payload runs under the origin of the router's management interface. This grants the injected script access to authenticated session cookies, CSRF tokens, and any UCI configuration endpoint the administrator can reach.

Root Cause

The root cause is missing HTML output encoding when rendering the resolver_url field on the status page. The application treats the persisted configuration value as trusted markup rather than untrusted string data. This violates the standard [CWE-79] contract of neutralizing input during web page generation.

Attack Vector

Exploitation requires an authenticated account with permission to modify the HTTPS DNS Proxy configuration and network reachability to the LuCI interface, typically over an adjacent network such as LAN or Wi-Fi. The attacker submits a crafted resolver_url containing an HTML or JavaScript payload. The payload triggers when a higher-privileged administrator views the status page, resulting in script execution in the administrator's session. See the VulnCheck Advisory on XSS for additional technical context.

Detection Methods for CVE-2026-67352

Indicators of Compromise

UCI configuration entries where the resolver_url value for https-dns-proxy contains HTML tags, <script> markers, on* event handlers, or javascript: URIs.
Unexpected outbound HTTP requests from an administrator's browser session immediately after visiting the LuCI HTTPS DNS Proxy status page.
Unauthorized changes to LuCI configuration or new administrator accounts created shortly after the status page is loaded.

Detection Strategies

Audit the /etc/config/https-dns-proxy file and any exported UCI configurations for non-URL characters in the resolver_url field.
Inspect LuCI request logs for POST requests writing resolver_url values that contain angle brackets or quote characters.
Deploy Content Security Policy violation reporting on the LuCI interface to surface inline script execution attempts.

Monitoring Recommendations

Monitor administrative sessions on OpenWrt devices for anomalous UCI writes or firmware changes originating from browser-triggered requests.
Alert on modifications to luci-app-https-dns-proxy configuration made by non-privileged accounts.
Track access patterns to the HTTPS DNS Proxy status page and correlate with subsequent privileged actions.

How to Mitigate CVE-2026-67352

Immediate Actions Required

Update luci-app-https-dns-proxy to the fixed version referenced in the GitHub Security Advisory.
Review the current resolver_url value on every OpenWrt device running the component and remove any entries containing HTML or script content.
Restrict LuCI access to trusted management networks and require strong authentication for all administrator accounts.

Patch Information

Refer to the OpenWrt LuCI project advisory GHSA-c6vf-395q-4jv6 for the patched release of luci-app-https-dns-proxy. Apply the update through opkg update && opkg upgrade luci-app-https-dns-proxy on affected devices, or install a firmware image that includes the fixed package.

Workarounds

Limit luci-app-https-dns-proxy configuration privileges to a minimal set of trusted administrators until the patch is applied.
Isolate the LuCI management interface on a dedicated VLAN that is not reachable from general user or guest networks.
Manually set resolver_url values via SSH and UCI, and validate them against a strict URL allow-list before deployment.

bash

# Verify the currently stored resolver_url does not contain HTML
uci show https-dns-proxy | grep resolver_url

# Reset to a known-good value if injection is suspected
uci set https-dns-proxy.@https-dns-proxy[0].resolver_url='https://dns.example.com/dns-query'
uci commit https-dns-proxy
/etc/init.d/https-dns-proxy restart