Tadqiqotchilar oddiy ommaviy ChatGPT ulashish havolasini hujumchi nazoratidagi JavaScript kodiga aylantirgan xatolar zanjirini topdilar, bu kod jabrlanuvchining tizimga kirgan sessiyasida ishlagan.
OpenAI muammoni 26-oktabrda tuzatdi va uni P1 deb tasnifladi. The Parameter tadqiqotchilarining to‘liq texnik yozuvi bu xato 5000 dollar mukofot olganini aytadi.
Hujumchi ChatGPT ulashish funksiyasidan foydalanib tayyorlangan suhbatni e’lon qilgan, va jabrlanuvchi faqat havolani bosishi kerak bo‘lgan. ChatGPT’ning HTML Preview funksiyasi ishonchsiz kodni cheklangan ramkada boshqa veb-manzilda ishlatsa-da, bu izolyatsiya samarali edi. Biroq zaiflik asosiy sahifaning boshqa komponentida bo‘lgan.
Suhbat interaktiv grafikni o‘z ichiga olgan, u MathLive matematik kutubxonasini yuklagan. MathLive asosiy sahifada ekran klaviaturasi uchun postMessage tinglovchisini o‘rnatgan.
Bu tinglovchi har qanday manbadan yangilash-sozlamasi xabarini qabul qilgan va qaysi oyna yuborganini tekshirmagan. Natijada, xabar klaviatura tartibini xom HTML bilan almashtirishi mumkin bo‘lgan.
Shaxsiy suhbat ma’lumotlari jabrlanuvchi sessiyasidan chiqib ketishi mumkinligini isbotlovchi nazorat (Manba: The Parameter)
Preview kodi ikkita xabar yuborgan: birinchisi tartibni taqdim etgan, ikkinchisi MathLive’ga klaviaturani ko‘rsatishni buyurgan. Keyin MathLive hujumchining belgilashini innerHTML yordamida sahifaga kiritgan.
createHTML yordamchisi satrni ishonchli deb belgilagan, lekin uni tozalamagan. Skriptlarni bajarish uchun tadqiqotchilar sandboxlanmagan srcdoc iframe’ni kiritgan, bu chatgpt.com identifikatorini meros qilib olgan va asosiy sahifa bilan o‘zaro aloqada bo‘lishi mumkin bo‘lgan.
ChatGPT’ning Kontent Xavfsizligi Siyosati (CSP) ichki skriptlarni bloklagan, lekin YouTube’dan skriptlarga ruxsat bergan. YouTube’ning oEmbed nuqtasi JSONP qayta chaqiruv parametrini javobida aks ettirgan, so‘ngra tekshirish xatosini qaytargan. Qayta chaqiruvni ;void bilan tugatish qo‘shilgan xato obyektini bekor qilgan va brauzer hujumchining kodini ishonchli skript sifatida bajarishiga imkon bergan.
Kiritilgan kod sahifadan sessiya tokeni va hisob identifikatorini olgan. Keyin /backend-api/conversations nuqtasi orqali so‘nggi suhbatlarni ro‘yxatga olgan va hujumchi ruxsat etilmagan shaxsiy chatni olgan. Tadqiqotchilar nazoratidagi serverga rasm so‘rovi orqali ushbu ma’lumotning kichik qismi yuborilgan. Aslida, kod jabrlanuvchi bajarishi mumkin bo‘lgan har qanday harakatni bajarishi mumkin edi.
Eng barqaror sinovda, havolani ochish yagona kerakli bosish bo‘lgan va yuklama taxminan 4,5 soniyadan keyin bajarilgan. OpenAI 21-oktabrda uni qayta ishlab chiqqandan so‘ng jiddiylikni P2 dan P1 ga ko‘targan. 26-oktabrga kelib, ikkala veb-front MathLive’ning ramkalararo xabarlarini rad etgan.
Tahdid aktorlari allaqachon haqiqiy ChatGPT ulashish havolalaridan foydalanib ClickFix aldovlarini joylashtirmoqda, bu NetSupport RAT’ga olib boradi. Bunday xatolar ulashish havolalarini yanada jozibador yetkazish yo‘liga aylantiradi.
Himoya darslari
- Qabul qiluvchilar event.origin va event.source’ni tekshirishlari kerak, holatni o‘zgartiruvchi xabarlarni qabul qilishdan oldin.
- Ramkalararo sozlamalar hech qachon xom HTML tashimasligi kerak.
- Ishonchsiz kontentdan qurilgan hujjatlar sandboxlangan holda qolishi kerak.
- CSP zaxira nazorat bo‘lishi kerak, yagona to‘siq emas.
OpenAI foydalanuvchilariga qarshi hisob ma’lumotlarini o‘g‘irlash ham faol, phishing kampaniyalari ish va shaxsiy loginlar bo‘yicha OpenAI hisoblarini nishonga olmoqda. Tuzatilgan ChatGPT himoya mexanizmini chetlab o‘tish xatosi ham fayl yuklab olish mexanizmi mahalliy fayl kiritish xavfini fosh etishi mumkinligini ko‘rsatdi. Har bir ulashiladigan AI yuzasini hujumchi yetib borishi mumkin bo‘lgan kirish sifatida ko‘ring.
SOC’ga hodisalarni tez to‘xtatish uchun ogohlantirish kontekstini bering.16K SOC’dan Tahdid Razvedkasini integratsiya qiling.
Researchers found a chain of flaws that turned an ordinary public ChatGPT share link into attacker-controlled JavaScript running inside the victim’s signed-in session.
OpenAI fixed the issue on October 26 and classified it as P1. The Parameter researchers’ full technical write-up says the bug earned a $5,000 bounty.
An attacker published a crafted conversation using ChatGPT’s sharing feature, and the victim only needed to click the link to be affected. Although ChatGPT’s HTML Preview feature runs untrusted code in a restricted frame on a different web address, that isolation was effective. The vulnerability, however, was in another component of the main page.
The conversation included an interactive graph that loaded the MathLive math library. MathLive installed a postMessage listener in the main page for its on-screen keyboard.
This listener accepted an update-setting message from any origin and failed to check which window sent it. As a result, the message could replace the keyboard layout with raw HTML.
Controlled proof that private conversation data could leave the victim’s session (Source: Parameter)
The Preview code sent two messages: the first provided the layout, and the second instructed MathLive to display the keyboard. MathLive then inserted the attacker’s markup into the page using innerHTML.
The createHTML helper marked the string as trusted but did not sanitize it. To execute scripts, the researchers injected an unsandboxed srcdoc iframe, which inherited the chatgpt.com identity and could interact with the parent page.
ChatGPT’s Content Security Policy (CSP)blocked inline scripts but allowed scripts from YouTube. YouTube’s oEmbed endpoint reflected a JSONP callback parameter in its response before returning a validation error. Ending the callback with ;void neutralized the appended error object, allowing the browser to execute the attacker’s code as a trusted script.
The injected code accessed the session token and account ID from the page. It then listed recent conversations through the /backend-api/conversations endpoint and retrieved a private chat the attacker was not authorized to access. An image request sent a small piece of that data to a server controlled by a researcher. In principle, the code could perform any action that the victim could take.
In the most stable test, simply opening the link was the only click required, and the payload executed after approximately 4.5 seconds. OpenAI elevated the severity from P2 to P1 after reproducing it on October 21. By October 26, both web frontends had rejected the cross-frame MathLive messages.
Threat actors already abuse legitimate ChatGPT shared links to host ClickFix lures that lead to a NetSupport RAT. Flaws like this one make shared links an even more attractive delivery route.
Defensive lessons
- Receivers should verify both event.origin and event.source before accepting state-changing messages.
- Cross-window settings should never carry raw HTML.
- Documents built from untrusted content should stay sandboxed.
- CSP should be a backup control, not the only barrier.
Credential theft against OpenAI users is also active, with phishing campaigns targeting OpenAI accounts across work and personal logins. A patched ChatGPT guardrail bypass flaw also showed how a file download mechanism could expose local file inclusion risk. Treat every shareable AI surface as attacker-reachable input.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.