Do the math: How we took over ChatGPT accounts

	Do the math: How we took over ChatGPT accounts(parameter.ai)
	344 points by armcat 1 day ago \| 168 comments
	tl;dr: Researchers chained ChatGPT's HTML Preview, a MathLive postMessage listener that accepted unauthenticated cross-frame messages containing raw HTML, an unsandboxed srcdoc iframe, and a YouTube oEmbed JSONP endpoint whitelisted by CSP to achieve arbitrary JavaScript execution as chatgpt.com from a single shared conversation link. Opening the share let attackers call ChatGPT's authenticated APIs as the victim—enumerating and exfiltrating private conversations. OpenAI patched the issue on October 26, classified it P1, and paid a $5,000 bounty.
	HN Discussion: ↑The $5,000 bounty is too low for a P1 vulnerability and may incentivize black market sales ↑This vulnerability highlights broader security concerns with ChatGPT's expanding attack surface ↑Growing code complexity and monolith architecture at OpenAI is the root cause of such vulnerabilities ↓The write-up's style and clarity made the technical exploit chain hard to follow ↑Appreciation for the clever chaining of old-school web primitives in the exploit