A shared ChatGPT link was enough to hijack your account
We Took over ChatGPT Accounts
Researchers at Parameter found that an ordinary public ChatGPT share could run attacker-controlled JavaScript inside the signed-in session of anyone who opened it. A conversation graph loaded MathLive, whose message listener accepted unverified cross-frame messages and injected raw HTML, which spawned an unsandboxed iframe with chatgpt.com identity; a YouTube JSONP endpoint then bypassed CSP. The payload enumerated private conversations and exfiltrated their contents. OpenAI fixed it on October 26 and rated it P1.
The victim did not need to install an App, join a Project, paste code, or open developer tools. Opening the shared link was the only required action.
- yellow_lead
> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.
It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.
- Kuyawa
$5000 is a joke. They pay millions to their top devs and still have more holes than a colander so a nice guy shows you a huge opening in your platform and all you can give him is a pat on the shoulder? Did you fire your top devs and hire that guy for a million bucks plus options? Did you sue the security firm you paid millions to audit the issues?
I really hope they get hacked and crash down burning in flames like the Hindenburg
- usernametaken29
Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it?
All jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically… so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that’s correct and adhere to established engineering standards over sensationalised “we built so much code” promotional material.
- jareklupinski
> able to take over anyone's account simply by sending them a link
dont click links people
that'll be $500k for the security training pls
- lxgr
Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad.
- dumberquestions
Does no one write their own blogs anymore?
- jwpapi
I think there was another HN discussion about it re bounty value and as far as I remember the issue is not that big companies are greedy in that case, but rather that over time it’s strategically better to have lower bounties so less people are interested in it.
5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.
- 6thbit
Appreciate the incremental write up building up the scope of the poc.
I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.