ChatGPT Vulnerability Exploited with a Single Click

Until recently, a single click on a shared chat link in ChatGPT by a stranger could have allowed them to view a user’s private conversations.

Cybersecurity firm Parametris disclosed the details of the attack chain in a comprehensive report published a few days ago, which was relayed by Al Arabiya News today. OpenAI, the developer of ChatGPT, had already patched the vulnerability by that time.

A report by the technology news site Notebookcheck stated that researchers reported the vulnerability through OpenAI’s bug bounty program on October 18. Since October 26, the web versions of the ChatGPT application have been secured against the attack.

Parametris stated that it had not observed any indicators of actual victims, and that the attack chain tests were limited to the company’s own accounts.

To render charts, ChatGPT relies on the MathLive library, which provides an on-screen keyboard for entering mathematical equations. This keyboard previously accepted messages from any other window and inserted loaded HTML content into the page without validation. This resulted in the creation of an insecurely isolated iframe, which the browser treated as part of the ChatGPT site itself. Additionally, the site’s security policies allowed loading scripts from YouTube, which researchers exploited to execute their own JavaScript code.

This code ran within the user’s logged-in ChatGPT session, enabling access to their entire conversation list, opening a private conversation that had not been shared before, and sending parts of it to an external server. Through ChatGPT’s internal APIs, the code could also perform actions on behalf of the user, which Parametris described as potentially leading to account takeover.