Executive brief
Deck9 Input is a tool used for managing form submissions and webhooks. A security flaw allows an attacker to send a malicious response from a remote server that, when viewed by an authorized user in the application's status dashboard, executes unauthorized scripts in their browser. This could lead to the theft of session information or unauthorized actions being performed on behalf of the logged-in user.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Deck9 Input v2.0.1. The 'CallWebhookJob' component captures and stores the HTTP response body from configured webhooks, which is subsequently exposed via 'FormSessionWebhookResource'. The frontend status UI renders this stored response as HTML rather than plain text. An attacker can exploit this by configuring a webhook to point to a malicious server that returns a payload (e.g., <script> tags). When an authenticated user views the submission webhook status, the payload executes in their browser context, potentially allowing for session hijacking or data exfiltration.
Affected products
- Deck9 Input 2.0.1
Timeline
- 2026-06-15: disclosed: Initial NVD publication date