ChatGPT Share Link Flaw Let Attackers Run Code and Read Private Chats, Researchers Find

A malicious ChatGPT share link could run an attacker's code inside the logged-in session of anyone who opened it, letting them read private conversations, security firm Parameter found.

The researchers reported the flaw through OpenAI's bug bounty program on October 18. OpenAI fixed it eight days later and rated it P1, its most serious category.

The trap was an ordinary ChatGPT conversation shared by public link, sent the same way as any real shared chat - by email, chat message, support ticket or social post. Victims installed nothing, joined no workspace and never signed in through the attacker. In the most reliable version, they opened the link and clicked ChatGPT's Preview button once; a later version opened Preview automatically, so opening the link was the only step.

Once open, the attacker's code ran with the same access as the real ChatGPT site. It listed the victim's recent conversations, opened a private chat never shared with the attacker and sent a small portion of it to a server the researchers controlled. The code called ChatGPT's signed-in APIs directly. "Essentially, we could perform any action on behalf of the victim's ChatGPT account," the researchers wrote.

The work was a controlled test. Parameter reports no real-world use of the flaw and ran its private-chat proof between separate accounts rather than against real users.

The chain worked through two features in the same conversation. Preview ran attacker HTML in a locked-down frame, and that sandbox held. But an interactive graph loaded the MathLive math library into the main ChatGPT page, leaving a listener that accepted keyboard messages from any sender - and allowed them to carry raw HTML. The Preview reached across the boundary and handed attacker HTML to the trusted main page, which built a frame the browser treated as part of chatgpt.com. A script from YouTube then supplied the running code, permitted because ChatGPT's content security policy allowed scripts from YouTube.

Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1 and rolled a fix across two versions of ChatGPT's web frontend. By October 26, both rejected the messages the attack relied on.

The researchers traced the problem to three design choices: MathLive acted on a settings-changing message without checking which frame sent it; that message could carry raw HTML as keyboard-layout data; and the HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity. Blocking the YouTube step alone would still leave an untrusted Preview able to push HTML into the main site.

ChatGPT users need do nothing - the fix is on OpenAI's side, with nothing to install or reset. Parameter published its writeup on October 28, after the fix. OpenAI paid $5,000 for the report.

Source: The Hackers News