Last week, ChatGPT creator OpenAI patched multiple severe vulnerabilities that could have allowed attackers to take over user accounts and view chat histories.
The first was a critical web cache deception bug that could have allowed attackers to access user information such as names, emails, and access tokens, which OpenAI’s API would fetch from the server.
To exploit the vulnerability, an attacker could craft a .css path to the session endpoint and send the link to the victim. When the victim opens the link, the response is cached and the attacker can harvest the victim’s credentials and take over their account.
Reported by Shockwave CEO and founder Gal Nagli, the bug was quickly addressed by instructing “the caching server to not catch the endpoint through a regex”.
The fix, however, was not enough to keep an attacker out of user accounts, security researcher and CISO Ayoub Fathi explains. While analyzing the fix, he discovered a bypass method that could be used against another ChatGPT API, providing an attacker with access to a user’s conversation titles.
This was basically another web cache deception attack: the API response to a forged ‘/backend-api/conversations’ link would be cached, revealing the victim’s HTTP response, which contains the conversations’ titles.
Digging deeper, the researcher was able to bypass OpenAI’s fix for the original account takeover issue, using a new payload, and discovered that all ChatGPT APIs were vulnerable to the bypass, allowing an attacker to read conversation titles, full chats, and account status.
Fathi says he worked with the OpenAI team to help them fully address all issues.
No bug bounty reward was issued to either researcher, as OpenAI does not have a bug bounty program in place.
The vulnerabilities were reported days after OpenAI took ChatGPT offline to address a vulnerability in an open-source Redis client library, which allowed users to view other users’ chat data and payment-related information.
Related: ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
Related: Microsoft Puts ChatGPT to Work on Automating Cybersecurity
Related:ChatGPT and the Growing Threat of Bring Your Own AI to the SOC