'LLM-mediated web attacks': eight classic vulnerability classes rerouted through the model — LLM2SQLi, LLM2SSRF, LLM2XSS and more

arXiv·medium signalXBlueskyLinkedInCopy link

Submitted August 10, this paper catalogs what happens when an LLM sits between user input and a vulnerable backend: the model does not create the flaw, it acts as a mediation layer that carries attacker-controlled data past the sanitization the application assumed was there. The authors define eight variants — LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2CSRF, LLM2XXE and LLM2SSRF — and test LLM2SSRF with a purpose-built target, TicketOracle, across seven models, finding wide variation in which models can be induced to relay the payload. Defenses are proposed at four layers: prompt design, model selection, application architecture and network controls. The practical takeaway is that model choice is now a web-application security control.