How We Took Over ChatGPT Accounts

Summary

Parameter Labs found an attack chain against ChatGPT's artifacts feature, where HTML previews run in a sandboxed iframe. A sandboxed frame could call a postMessage() handler in the parent page, used by the MathLive library's virtual keyboard, that writes via innerHTML, letting it inject an unsandboxed iframe. Abusing a YouTube oEmbed endpoint allowed by CSP reflected JavaScript that executed, so a crafted ChatGPT share URL could exfiltrate another signed-in user's private data or act on their behalf. OpenAI closed the hole and paid a $5,000 bug bounty.

Mitigation

OpenAI closed the hole. No further mitigation is stated in source.

Related items

• InfoOpenAI pares fundraising goal, now seeking up to $20 billion in latest roundSame vendor · CNBC Technology
• InfoHumans are still doing the work behind some AI agentsSame vendor · CNBC Technology
• MediumAppraisal by AI: Model-driven victim prioritization in the VOLTA infostealerSame vendor · Cisco Talos Blog
• MediumA Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsSame vendor · The Hacker News
• InfoSam Altman says it’s better for RAM to be in a data center than on your deskSame vendor · The Verge (AI)