OpenAI paid security firm Parameter $5,000 for reporting a ChatGPT shared-link flaw that could run attacker code in a signed-in user’s session, The 420 reported on 31 October. The researchers demonstrated access to private conversations that the user had never shared with an attacker. Parameter disclosed the research on 28 October, after OpenAI had deployed fixes to two versions of the ChatGPT web frontend.
Key points
- A crafted shared conversation link could run code in a user’s signed-in ChatGPT session.
- Parameter demonstrated access to an unshared private chat and sent part of it to a server the researchers controlled.
- OpenAI rated the flaw P1 and had fixed both affected web frontend versions by 26 October.
Parameter’s link reached private chats
ChatGPT lets users make conversations available through public links. Parameter’s malicious version looked like an ordinary shared chat, but it carried content designed to reach beyond that conversation and into the account of a user who opened it while signed in.
In one version of Parameter’s test, the user also had to click ChatGPT’s Preview button, which renders HTML from a conversation. The researchers later demonstrated a version that triggered Preview automatically, so opening the crafted link could start the attack.
Parameter demonstrated code that listed recent conversations and opened a private chat the user had not shared with the attacker. It sent a small portion of that chat to a server under the researchers’ control. The code called ChatGPT’s authenticated APIs from the user’s active session rather than reading only what appeared on screen.
MathLive carried HTML into ChatGPT
Preview normally places conversation HTML in a restricted browser frame, separate from the main ChatGPT page. Parameter said that restriction worked. The route into the signed-in session came from an interactive graph in the same shared conversation, which loaded a mathematics library called MathLive in the main page.
MathLive left a listener for messages concerning its on-screen keyboard. Parameter found that the listener accepted certain messages without adequately checking which browser frame had sent them, and that the messages could contain raw HTML. The restricted Preview frame could therefore pass attacker-controlled HTML into the main ChatGPT page.
That HTML created another frame which the browser treated as belonging to chatgpt.com. The researchers then used a script loaded from YouTube to run code in that trusted context. Parameter identified the unchecked message and the resulting HTML injection as the route across the boundary, rather than YouTube itself.
OpenAI fixed both versions by 26 October
Parameter reported the flaw through OpenAI’s bug bounty programme on 18 October. OpenAI reproduced the code execution and private-chat demonstration, then raised the issue from P2 to P1, its highest severity category, The 420 reported.
OpenAI changed the web frontend to reject the messages needed for the attack. By 26 October, Parameter said, both affected versions rejected them.
Parameter said it carried out the private-chat test between accounts it controlled. The firm said it had no evidence that the flaw had been exploited against real users.
