From Prompt to Pwned Chaining LLM and Web Vulnerabilities to...

[carlospolop]

Blog URL

http://blog.quarkslab.com/from-prompt-to-pwned-chaining-llm-and-web-bugs-to-admin.html

Blog Title

From Prompt to Pwned: Chaining LLM and Web Vulnerabilities to Administrator Takeover

Blog high summary

FailMed AI trusted LLM output as active Markdown/HTML. Prompt injection caused image requests that exfiltrated base64 medical summaries and produced an iframe with a javascript: URL for XSS. The JWT cookie lacked HttpOnly, Secure, and SameSite, so XSS could read and exfiltrate accessToken.

An IDOR at /api/chat/ delivered the stored payload to authenticated users; replaying an admin JWT enabled platform takeover. No OS privilege escalation or CVE was reported.

PR changes

• src/AI/AI-Prompts.md: Added or revised coverage of Insecure LLM Output Handling: Prompt Injection to Browser XSS; Markdown resource loading as an exfiltration sink; Active HTML and cross-user stored XSS; Testing and hardening checklist.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: dbc4afa9fc4f73ebefb0930e51c9ed1e69dd1bb1

Adds source-backed coverage of insecure LLM output handling, including browser-side Markdown exfiltration and a cross-user stored-XSS chain through conversation-level authorization failure.

• The Quarkslab research directly supports the described Markdown resource loading, active HTML rendering, missing conversation ownership check, readable session cookie, and resulting account-takeover chain.
• Existing pages cover the individual Markdown XSS, IDOR, cookie, CSP, and streaming-output mechanisms, but not this reusable LLM-to-cross-user delivery chain.
• The AI Prompts page is the appropriate canonical location, with links to the established web-security pages for the underlying mechanisms.
• Editorial repairs corrected mdBook directory links and narrowed hardening claims to the verified scope.
• The base changed after review; source/coverage and candidate validation need a fresh review. No repairs or merge signal were published.

Editorial repairs:

• src/AI/AI-Prompts.md: Changed links targeting directory README files to mdBook-compatible directory URLs and removed unsupported or duplicative hardening details while preserving the submitted technique and examples.

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: dbc4afa9fc4f73ebefb0930e51c9ed1e69dd1bb1

This proposal needs a fresh or manual review before a merge signal can be posted.

• repair_loses_submitted_code

[livingthedream5]

STOP

…

On Sun, Oct 11, 2026, 12:50 PM SirBroccoli ***@***.***> wrote: *carlospolop* left a comment (HackTricks-wiki/hacktricks#2852) <#2852 (comment)> Sunday editorial verdict: *defer* Reviewed head: dbc4afa This proposal needs a fresh or manual review before a merge signal can be posted. - repair_loses_submitted_code — Reply to this email directly, view it on GitHub <#2852?email_source=notifications&email_token=APD3LAYS6UKDQBRUYJKRD4L5TPQBTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJRGMYDGNZQGY2KM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-6113037064>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/APD3LA3D2RMX3XCPTZEUVT35TPQBTAVCNFSNUABFKJSXA33TNF2G64TZHMZDOOJZGA4DMOBZHNEXG43VMU5TKNBUHE2DANZWGM2KC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/APD3LA56KOPVH6NMDADUHG35TPQBTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJRGMYDGNZQGY2KM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/APD3LA7LVHCNNDDQ5GZRYID5TPQBTA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTMMJRGMYDGNZQGY2KM4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: dbc4afa9fc4f73ebefb0930e51c9ed1e69dd1bb1

This proposal needs a fresh or manual review before a merge signal can be posted.

• uncertain_or_incomplete_review

[carlospolop]

Sunday editorial verdict: defer
Reviewed head: dbc4afa9fc4f73ebefb0930e51c9ed1e69dd1bb1

This proposal needs a fresh or manual review before a merge signal can be posted.

• close_without_complete_invalidity_evidence

[carlospolop]

Sunday editorial verdict: close
Reviewed head: dbc4afa9fc4f73ebefb0930e51c9ed1e69dd1bb1

The proposal combines prompt injection, model-generated Markdown or HTML, browser rendering, IDOR, and exposed session cookies into an account-takeover scenario. The source supports that reported chain.

The current book already documents each reusable mechanism and prerequisite. The scenario adds no distinct constraint, failure mode, compatibility detail, or meaningful tool workflow beyond that covered combination.

• Current coverage already maps model-controlled output through Markdown/HTML interpreters and identifies links, image retrieval, and browser requests as data-egress channels.
• The Markdown XSS, IDOR/BOLA, cookie HttpOnly, and CSP pages already document the web primitives used by the reported scenario. Combining them with prompt injection is chain-only, not a new mechanism.
• The source describes Spikee running a preconfigured dataset and inspecting responses, but provides no distinctive parameter, limitation, or workflow sufficient to qualify as new tool usage.
• The testing and hardening material is generic or duplicates existing canonical guidance; parts of the expanded checklist are not specifically supported by the cited article.
• Every proposed reusable contribution is rejected as duplicate, chain-only, generic tool usage, or out of scope, so no editorial repair is warranted.

[carlospolop]

Conflict repair: resolved
Head: 51b4b10db3d11383db536896dbe10dc1b2d69157

Integrated the PR’s insecure LLM output-handling coverage while retaining the default branch’s malware-triage prompt-injection material.

• Preserved all substantive text, headings, attribution, and complete fenced examples from both versions.
• Kept distinct browser-rendering and malware-triage contexts without conflating their claims or sources.
• Reconciled references as 23–25 and repaired the cookie documentation link to its rendered index destination.
• Static preservation, local-link, citation, heading, whitespace, conflict-marker, and unmerged-path checks passed.