A research team at Parameter.ai identified a critical security flaw in OpenAI's ChatGPT platform that allowed for full account takeover via a public sharing link. The vulnerability emerged from a combination of three seemingly harmless features: a math-related interactive graph, an HTML Preview tool, and a specific Content Security Policy (CSP) configuration. By crafting a malicious conversation and sharing it publicly, an attacker could trick a signed-in user into executing code that ran with the same permissions as the user's own web session, effectively granting the attacker access to the user's authenticated APIs.
This visual illustrates how the public sharing feature was leveraged to inject malicious content into the user's session.
The technical mechanism relied on a 'sandbox escape' involving a math library called MathLive. While ChatGPT's Preview feature normally isolates code in a restricted frame, the MathLive library installed a listener in the main ChatGPT page to handle messages for an on-screen keyboard. Because the listener did not verify the origin of incoming messages, the isolated Preview frame could send a `postMessage` to the main page. This message instructed the main page to render a new keyboard layout containing raw HTML. The researchers found that the main page's `createHTML` helper failed to sanitize this input, allowing the injection of an `iframe` with a `srcdoc` attribute. Because the main page created this frame, the browser granted it the `chatgpt.com` identity, bypassing the standard isolation of the Preview tool.
To bypass the site's Content Security Policy, which blocked inline scripts, the researchers utilized a JSONP-style callback from YouTube's oEmbed endpoint. Since ChatGPT's CSP allowed scripts from YouTube, the researchers used a specially crafted callback to execute arbitrary JavaScript within the newly created frame. Once execution was achieved, the team demonstrated they could call ChatGPT's backend APIs to enumerate a victim's recent conversations and retrieve the content of private chats that had never been shared. OpenAI addressed the issue by updating its web frontend to reject the cross-frame messages and and classifying the report as a P1 (high priority) severity bug. The researchers noted that the bug was a result of system complexity, where individual components functioned correctly in isolation but created a dangerous path when combined in a single page.
This image provides a visual proof of the researchers' ability to retrieve private chat content using the discovered vulnerability.