Researchers at Parameter chained two ChatGPT functions together to get out of the HTML preview sandbox. OpenAI fixed the flaw in eight days and paid $5,000.
Opening the public link of a ChatGPT conversation, then clicking the preview button once: that's all it took for an attacker to take control of a logged-in victim's account. Researchers from the security company Parameter showed that their code could list the target's recent conversations, open a private chat that had never been shared, and exfiltrate an excerpt from it to a server. In a later version of the attack, the preview even launched itself: opening the link was enough. The code directly called ChatGPT's internal APIs, with the same rights as the official website.
The sandbox held, it was the neighbor who gave in
The preview feature, which turns an HTML block into a minipage, does run in an isolated frame on a separate domain. But the same conversation contained an interactive graph whose display loaded the MathLive math library into the main page. The library let a message listener run, intended for its virtual keyboard, which did not check the sender and accepted raw HTML. The preview could therefore inject content into the trusted page; it remained to bypass the content security policy, which blocked online code but allowed scripts from YouTube.
Reported on October 18 via the bug bounty program, the flaw was reproduced by OpenAI, raised from P2 to P1 (its most serious category) and fixed on October 26 on both versions of the web front-end. Parameter says it has not seen any real exploitation and has only tested its proof of concept between its own accounts. Users don't have to do anything: the patch is server-side.
Read the full article on the original source
Go to the source →