Executive brief
luci-app-https-dns-proxy is a web interface component for managing HTTPS DNS proxy services in OpenWrt routers. An authenticated user with limited privileges can inject malicious HTML/JavaScript into the resolver URL setting, which executes in the administrator's browser when the status page is viewed, enabling account hijacking and unauthorized router configuration changes.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in luci-app-https-dns-proxy's resolver_url parameter. A limited authenticated user (with only luci-app-https-dns-proxy ACL access) can write arbitrary HTML to the UCI resolver_url configuration. When an administrator views the HTTPS DNS Proxy status page, the LuCI frontend reads the resolver URL from service.list and renders it as raw HTML without escaping, causing attacker-supplied JavaScript to execute in the administrator's LuCI origin. The vulnerability spans a privilege boundary—an unprivileged user exploits misconfigured ACLs to inject a payload that affects the higher-privileged administrator. Patches are not yet available as of the advisory publication date.
Affected products
- OpenWrt luci-app-https-dns-proxy 2026.03.18-r1 and earlier
Timeline
- 2026-07-17: disclosed: Security advisory GHSA-c6vf-395q-4jv6 published by OpenWrt team
- 2026-08-01: advisory: CVE-2026-67352 published on NVD