Sejda Workflows — import DOM XSS (PoC)

Authorized security-assessment proof-of-concept for https://www.sejda.com/workflows. Imported workflow files have their step names rendered into the page with jQuery .html() without escaping, so a crafted workflow file executes JavaScript on the www.sejda.com origin (cookie-less anonymous context included; no CSP present).

1) Download the PoC workflow file

2) Import it

  1. Open https://www.sejda.com/workflows (works logged-out or logged-in)
  2. Click Import and choose sejda_workflows_demo.json
  3. Watch the browser tab: the page title flips to R13XSS — the script executed. A broken-image node also appears inside the workflow row (that is the injected <img onerror>).
The payload is intentionally harmless (it only sets document.title) — a real attacker's script would run with full access to the page origin, including the visitor's session.

Instant proof (no file needed) — paste in the browser console on the workflows page

await Sejda.Workflows.saveOrUpdate({id:'DEMO-1',name:'demo',tasks:[{uri:'/merge-pdf',type:'merge',files:[]}],steps:['<img src=x onerror="alert(document.domain)">']}); location.reload();

An alert box showing www.sejda.com appears on reload — same sink, same origin.

Cleanup

In the same console: Sejda.Workflows.deleteAll()