Researchers demonstrate ChatGPT account takeover through a public conversation link
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
A public conversation link could expose private chats; the issue has been fixed, and its analysis shows why every connection between service components must be isolated.
The Parameter team discovered a vulnerability chain in which opening a specially crafted public ChatGPT conversation executed JavaScript in the visitor's authenticated session. The researchers demonstrated reading the chat list, retrieving the contents of a private conversation and sending data to an external server; the attack required no app installation or developer tools. The chain combined HTML Preview, a MathLive message handler that did not verify the sender, creation of an unsandboxed frame and a CSP bypass through the allowed YouTube domain. OpenAI confirmed reproduction of the issue, raised its priority to P1, fixed both web frontend versions on October 26 and awarded the researchers $5,000.
Sources 1