Critical ChatGPT exploit: account takeover vulnerability
In brief
- Parameter Labs finds a flaw in ChatGPT’s sandboxed iframe system.
- Attack leverages MathLive and YouTube oEmbed to execute malicious code.
- OpenAI patches the flaw and pays a $5,000 bug bounty to Parameter Labs.
Parameter Labs uncovered a security flaw in OpenAI’s implementation of ChatGPT’s interactive artifacts system (formerly "Canvas", now "HTML previews"). According to their report, the vulnerability stems from a complex attack chain exploiting the MathLive JavaScript library and improperly secured postMessage interactions between sandboxed iframes and the parent page.
The exploit allows untrusted code in an iframe to inject HTML and execute JavaScript via YouTube’s oEmbed endpoint, bypassing OpenAI’s CSP rules. Once code execution is achieved, attackers can steal private user data or perform actions on behalf of victims. OpenAI patched the flaw and awarded Parameter Labs a $5,000 bug bounty.
What it changes for you
- CybersecurityCybersecurity teams must verify CSP enforcement and iframe sandboxing in their own solutions.
This summary gives you the essentials. The full article, its figures and quotes are on Simon Willison's Weblog.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error