A recently disclosed vulnerability in ChatGPT demonstrated how a maliciously crafted shared conversation link could execute attacker-controlled code within a victim’s logged-in session. The issue was identified by security researchers at Parameter, who demonstrated that the flaw could expose private conversations and allow actions to be performed using the victim’s authenticated account. The vulnerability was reported to OpenAI through its bug bounty program on October 18 and was remediated eight days later. OpenAI classified the issue as P1, its highest severity rating.
The attack required no software installation, workspace membership, or separate login through the attacker. A victim could receive the malicious ChatGPT share link through email, a messaging platform, a support ticket, or social media. In the most reliable version of the attack, the victim opened the link and clicked the Preview button once. In a later variant, Preview opened automatically, meaning that merely opening the link was sufficient to trigger the attack.
Once triggered, the malicious code executed within the victim’s ChatGPT session and could interact with ChatGPT’s signed-in APIs. The researchers showed that it could list recent conversations, access a private chat that had never been shared, and transmit part of its contents to an external server under their control. Because the code operated within an authenticated session, it had the potential to perform actions on behalf of the affected user.
The vulnerability resulted from a combination of weaknesses in ChatGPT’s web architecture. ChatGPT’s Preview feature renders shared HTML in a sandboxed frame on a separate domain, intended to isolate it from the main ChatGPT application. However, an interactive graph in the shared conversation loaded the MathLive mathematics library into the main ChatGPT page. This library retained a message listener that accepted keyboard-related messages from any sender without verifying their origin. The researchers exploited this behavior to send raw HTML from the isolated Preview frame into the trusted main ChatGPT page.
OpenAI reproduced both the code-execution and private-chat proof-of-concept demonstrations and implemented fixes across two versions of its web frontend. By October 26, both versions rejected the messages on which the attack depended. Parameter published its technical analysis on October 28 after the remediation, and OpenAI awarded a total of $5,000 through its bug bounty program. The researchers also noted that the issue reflected broader weaknesses in message-origin validation, HTML handling, and sandboxing, rather than a problem that could be resolved simply by blocking third-party scripts such as YouTube.
Read the original article:
ChatGPT Share-Link Flaw Could Expose Private Chats and Hijack Sessions