ChatGPT share-link chain let attackers run script in signed-in sessions
Original title: Researchers Discover High-Severity ChatGPT Flaw That Exposed Private Conversations to Attackers
OpenAI rated the issue P1, paid a $5,000 bounty, and blocked the cross-frame MathLive messages on both web frontends by October 26.
Parameter researchers chained ChatGPT share links, a MathLive postMessage listener, and a YouTube JSONP reflection so a victim who opened a crafted public conversation ran attacker JavaScript inside a signed-in chatgpt.com session. The script could read the session token and account ID, list conversations, and pull a private chat the attacker was not allowed to see. OpenAI reproduced it on October 21, raised it from P2 to P1, and by October 26 both web frontends rejected the cross-frame MathLive messages. The write-up does not say this specific flaw was used in attacks.
Unconfirmed: The $5,000 bounty figure comes from the Parameter write-up; real-world exploitation of this chain is not stated.
- Opening the share link was enough; the payload ran after about 4.5 seconds.
- MathLive accepted an update-setting message from any origin and inserted raw HTML via innerHTML.
- CSP blocked inline scripts but allowed YouTube, whose oEmbed JSONP callback was abused.
- Injected code called /backend-api/conversations and exfiltrated a fragment of a private chat.
- OpenAI fixed both web frontends on October 26 after reproducing the bug on October 21.
Impact: session token theft and unauthorized private chat access
| Product | Affected |
|---|---|
| OpenAI ChatGPT | — |
- 1.Treat ChatGPT share links as untrusted until the October 26 frontend fix is in effect.
- 2.Verify event.origin and event.source before accepting cross-window state changes.
- Vendors
- OpenAI
- Malware
- NetSupport RAT
- Organizations
- Parameter
From the original article
2 min read at gbhackers.com
Researchers found a chain of flaws that turned an ordinary public ChatGPT share link into attacker-controlled JavaScript running inside the victim’s signed-in session. OpenAI fixed the issue on October 26 and classified it as P1. The Parameter researchers’ full technical write-up says the bug earned a $5,000 bounty.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.