Researchers from the security firm Parameter recently uncovered a significant vulnerability in ChatGPT, revealing that attackers could execute code within a user’s active session and access private conversations. This issue was reported to OpenAI on October 18 and quickly addressed within eight days, earning a P1 classification, the highest severity rating.
Details of the ChatGPT Vulnerability
The vulnerability was tied to the way ChatGPT handles shared links. A seemingly benign shared conversation link could be sent through various channels, such as email or social media. The unsuspecting recipient only needed to open the link and click on the Preview button for the attack to be initiated. In some cases, the link was configured to automatically trigger the Preview feature, simplifying the attack process.
Once initiated, the attacker’s code operated within the victim’s session, accessing the same privileges as the legitimate ChatGPT user. This allowed the attacker to list recent conversations, open private chats, and transmit portions of these chats to a server controlled by the researchers. The code leveraged ChatGPT’s signed-in APIs, which broadened its potential impact beyond just chat access.
Technical Breakdown of the Exploit
The exploit hinged on ChatGPT’s Preview feature, which can transform HTML blocks into web pages. Although these pages are designed to run in a restricted environment, a flaw in a secondary feature compromised this sandbox. An interactive graph within the shared chat loaded a math library called MathLive, which inadvertently created a vulnerability. This library left a listener on the main ChatGPT page that accepted unverified messages, including raw HTML.
The exploit enabled the attacker to inject HTML into the main page, creating a new frame that browsers recognized as legitimate chatgpt.com content. By loading a script from YouTube, the attacker executed their code within this frame. Although ChatGPT’s security policies restrict inline scripts, they permitted scripts from YouTube, facilitating the attack.
OpenAI’s Response and User Guidance
OpenAI promptly responded by replicating the vulnerability and upgrading its severity rating. The company implemented a fix across its web platforms by October 26, effectively blocking the messages that enabled the attack. The researchers identified several design oversights that contributed to the flaw, including MathLive’s acceptance of unverified messages and the ability to inject unsanitized HTML into ChatGPT’s main page.
Users of ChatGPT are not required to take any action, as OpenAI’s fixes were server-side and do not necessitate user intervention. The comprehensive solution ensures that the vulnerability is no longer exploitable. Parameter Security publicly shared their findings on October 28, following the resolution, and received a $5,000 reward from OpenAI as part of their bug bounty program.
This incident underscores the importance of rigorous security protocols and continuous monitoring to safeguard user data in web applications.
