External risk intelligence

Softr Account Page HTML Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-40434

Softr is a platform used to build web applications and portals. As a web-based service, the account management pages and application interfaces are typically hosted as internet-facing web applications, making the vulnerable input field commonly reachable from the public internet.

Cross-site Scripting

Softr

2.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Softr platform, which is used for building web applications and portals. This issue, an HTML injection flaw, could allow unauthorized access or manipulation of data within affected applications if exploited. The main concern at this time is to confirm if our organization utilizes this technology and whether it is exposed.

Allows injecting malicious content into web pages.
Affects web applications and customer portals.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can inject malicious HTML into the "Name" field on the Account page of Softr v2.0. This vulnerability is accessible through the network, requires no authentication or user interaction, and can lead to a complete compromise of the application, including data theft, manipulation, and denial of service.

No authentication needed for access.
Submit crafted HTML in the Name field.
High risk of data compromise and control.

Live Threat

Current exploitation, exposure, and threat context

When the Name field on the Account page in Softr v2.0 is manipulated, it could allow an attacker to inject HTML. This could potentially impact the display of content or lead to unintended actions within the application.

User profile data and application content.
Through manipulated Name field input.
Display of sensitive information or unauthorized actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Softr's account page affects applications built with it. Owners of these applications, potentially managed by platform or development teams, should prioritize identifying all instances of Softr v2.0. Once identified, confirm their exposure and business criticality to accurately assess risk before planning remediation.

Application owners are responsible.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Softr and why is it used?

Softr is a no-code platform that allows users to create web applications and portals using data from sources like Airtable or Google Sheets. It is commonly used by businesses to quickly build client portals, internal tools, and directories without needing traditional software development skills.

What is the vulnerability in CVE-2022-40434?

This CVE involves an HTML injection vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It occurs because the application fails to properly sanitize user-provided text, allowing an attacker to insert malicious HTML code that the browser will then execute or render as part of the page.

How does an attacker trigger this HTML injection?

The flaw is triggered by inputting crafted HTML code specifically into the 'Name' field on the Account page of Softr v2.0. The vulnerability does not require authentication or user interaction to be triggered, meaning a remote attacker can potentially submit this malicious payload directly if they have access to the affected input field.

Is my instance of Softr at risk?

According to Halo Surface Signal, Softr is a web-based service where account management pages are typically hosted as internet-facing applications. Because these interfaces are commonly reachable from the public internet, any organization using version 2.0 should consider their deployment exposed and prioritize a review.

What steps should I take if I use this software?

First, identify all instances of Softr v2.0 within your environment. Once you have a list of affected applications, assess the business criticality of each to determine the potential impact of a compromise. Coordinate with your platform or development teams to verify the specific configuration and plan your next steps for mitigation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.