Researchers Showed How ChatGPT Shared Links Could Enable Code Execution and Private-Chat Access
Summary
Parameter researchers demonstrated that a malicious ChatGPT share link could run code in a logged-in session and access private chats. OpenAI fixed the flaw by October 26; the controlled test involved no real users.
Key points
- A malicious shared conversation could run attacker-controlled code in a victim's logged-in ChatGPT session after opening the link and, in an earlier version, clicking Preview.
- The researchers showed the code could list recent conversations, open a private chat, and send a portion of it to a researcher-controlled server.
- The exploit chain combined ChatGPT Preview, an interactive graph that loaded MathLive, and a listener that accepted keyboard messages from any sender, including raw HTML.
- The injected HTML created a frame treated as part of chatgpt[.]com; a script loaded from YouTube supplied the code, which the site's content security policy allowed.
- Parameter conducted a controlled proof using separate accounts and reported no real-world use of the flaw.
- OpenAI reproduced the issue, rated it P1, and fixed it across two web frontend versions by October 26; users need take no action.
Article Details
- Attack Vectors
- A malicious ChatGPT shared-conversation link carried an interactive graph and HTML for the Preview feature. Opening the link and, in the more reliable version, clicking Preview enabled attacker-supplied HTML to cross from the sandboxed frame into the trusted ChatGPT page.
- A MathLive keyboard-message listener in the main page accepted messages from any sender, including raw HTML. The injected HTML created a frame treated as part of chatgpt.com; a script loaded from YouTube then supplied code that ran with the victim's signed-in session access.
- The code used ChatGPT's signed-in APIs to list recent conversations, open a private conversation, and send a portion to a researcher-controlled server in a controlled test.
- Defensive Notes
- OpenAI fixed the issue by October 26, and both affected frontend versions rejected the messages used in the attack. The article says ChatGPT users do not need to install or reset anything.
- Parameter reported no real-world use of the flaw; its private-chat proof used separate test accounts.
MITRE ATT&CK
T1059.007 · JavaScriptAfter injected HTML created a frame treated as part of chatgpt.com, a script loaded from YouTube supplied code that executed in the victim's signed-in session.T1189 · Drive-by CompromiseThe attack began when a victim opened a malicious ChatGPT shared-conversation link and, in the more reliable version, clicked Preview, triggering exploitation in the web session.