From Prompt to Pwned: chaining LLM and web vulnerabilities to seize admin access
Attack Techniques & Methods2026-06-26, 07:22
Quarkslab published research in which they managed to compromise a web application with an LLM chatbot interface. To demonstrate the attack, they built a lab environment based on a real Red Team engagement that emulated a medical AI assistant called FailMed AI in a simulated production environment.
The setup includes:
•Frontend — React and Vite with a medical history interface and a chatbot
•Backend — Flask REST API with JWT authentication, a vulnerable endpoint
/api/chat, and SQLite for storing patient dataVulnerability chain:
- Prompt Injection + Insecure Output Handling — the LLM's response was rendered as Markdown, allowing arbitrary JavaScript injection due to the lack of CSP
- XSS — a payload such as
<iframe src='javascript:alert("Quarkslab")'>was successfully executed in the chat interface - The JWT token was stored in a cookie without
HttpOnly,SecureandSameSiteattributes - IDOR via chat ID — anyone could access another user's conversation through a direct link
Attack chain: the attacker creates a conversation containing the injected XSS through the LLM and sends the link to an admin → the admin opens the link → the XSS payload executes → the JWT token is stolen from the cookie → full administrative access is gained
The article shows that when developers neglect basic security practices (such as output filtering for LLM responses, CSP, and other protections), combining LLM-specific and classic web vulnerabilities can have serious real‑world impact.
Vendors
Products