A security research team has disclosed a vulnerability in ChatGPT shared links that could have allowed malicious code to run within a logged-in user session and access private conversations. Researchers from security firm Parameter reported the issue through OpenAI’s bug bounty program on October 18, and OpenAI addressed the vulnerability eight days later after rating it as a P1 issue, its highest severity category.
The issue involved a specially crafted ChatGPT shared conversation link that appeared similar to a normal shared chat. Such links could be distributed through common channels including email, chat messages, support tickets, or social media posts. According to Parameter’s research, users did not need to install any software, join an organization workspace, or authenticate through an attacker-controlled page. In the most reliable version of the demonstration, users only needed to open the shared link and select ChatGPT’s Preview option. A later version developed by researchers allowed the Preview page to open automatically, reducing user interaction further. Once the attack chain was triggered, the researchers demonstrated that code could execute within the user’s authenticated ChatGPT browser session. This provided access similar to the permissions available to the legitimate ChatGPT website. During the controlled test, Parameter showed that the vulnerability could allow access to recent conversations, including opening a private conversation that had not been shared with the researcher. A limited portion of that conversation was then transmitted to a separate research-controlled server. Parameter clarified that the demonstration was conducted between test accounts and that no evidence of real-world exploitation was identified.
The vulnerability was linked to how different ChatGPT web features interacted with each other. ChatGPT’s Preview feature allows HTML content inside a conversation to be displayed as a small webpage. To protect users, this content runs inside a restricted browser frame hosted separately from the main ChatGPT website. However, Parameter found that another interactive element in the same conversation created a path around those protections. The shared chat included an interactive graph that loaded the MathLive library into the main ChatGPT page. A listener associated with MathLive accepted messages related to keyboard settings but did not properly verify the source of those messages. Researchers found that these messages could include HTML content, allowing the Preview environment to send content into the trusted page. The researchers explained that the final stage of the demonstration involved creating a frame that the browser recognized as part of the ChatGPT website environment. A script hosted through YouTube was used to execute the required code because ChatGPT’s content security policy restricted some script sources while permitting others. Parameter noted that the YouTube script was only part of the final execution method and was not the root cause of the vulnerability.
OpenAI implemented fixes across two versions of the ChatGPT web frontend to prevent the message handling behavior used in the research. After the update, the affected versions rejected the messages required for the attack chain. Parameter identified three main design factors that contributed to the issue: MathLive accepted configuration messages without verifying the sender, those messages allowed raw HTML content, and the injected HTML could create a frame with access associated with chatgpt.com. The researchers emphasized that removing only the external script method would not fully resolve the underlying issue. ChatGPT users do not need to take any action because the fix was applied by OpenAI without requiring software updates or account resets. Parameter published its technical analysis on October 28 after the vulnerability had been resolved. OpenAI awarded the researchers a total bounty payment of $5,000 for responsibly reporting the security issue.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
