OpenAI fixes ChatGPT share-link flaw after $5,000 report

An attacker could create a malicious conversation, publish it through ChatGPT’s regular sharing feature and send the link to another user.[1] Parameter said opening the shared link was the only required action, while The Hacker News described the most reliable version as requiring the victim to open the link and click Preview once.[2][1] The victim did not need to install an app, join a project or paste code, according to Parameter.[1] The researchers demonstrated that the attack could list conversations, retrieve a private chat never shared with the attacker and send chat data to an external server.[1]

ChatGPT’s Preview feature can turn an HTML code block into a small working webpage, and Parameter said Preview content runs inside a restricted frame at a different web address.[1] The exploit chain used an interactive graph that loaded the MathLive mathematics library.[1] MathLive added a listener to the main page for messages related to its on-screen keyboard, but did not check the sender for a setting the researchers targeted.[1] The accepted keyboard layout could contain HTML, which MathLive inserted into the real ChatGPT page.[1] Separately, Simon Willison said the YouTube oEmbed endpoint could reflect JavaScript in a way that executed it.[3]

The researchers reported the flaw through OpenAI’s bug bounty program on October 18.[2] OpenAI fixed it on October 26 and classified it as P1, which The Hacker News described as the company’s most serious category.[2] Parameter also reported the October 26 fix and P1 classification.[1] OpenAI says its Bug Bounty Program recognizes and rewards researchers who contribute to keeping its technology and company secure.[4] Simon Willison reported that OpenAI paid a $5,000 bounty and said he thought the amount was low for a vulnerability of this severity.[3] Parameter published its account on October 28.[1]