Parameter Labs Details ChatGPT Account Takeover via Sandbox Escape

Parameter Labs described an exploit against ChatGPT's implementation of the artifacts pattern, which OpenAI previously called "Canvas" and now calls HTML previews, where interactive custom HTML apps run in a sandboxed iframe. The chain could let an attacker create a ChatGPT share URL that, when opened by another signed-in user, could exfiltrate private data or take actions on that user's behalf. OpenAI closed the vulnerability and paid a $5,000 bug bounty.

How the attack chain worked

ChatGPT uses the MathLive JavaScript library for graph support, and that library includes a virtual keyboard. The keyboard can be triggered in the parent page through postMessage() from the sandboxed iframe. The code that receives those messages uses innerHTML, and there was no mechanism to stop other sandboxed frames, including HTML preview frames, from calling that method.

That allowed untrusted iframe code to insert custom HTML into the parent page. Although innerHTML does not directly execute script elements, it could be used to inject a new iframe without sandbox restrictions. OpenAI's content security policy blocked inline scripts and allowed script loading from only a handful of domains, but YouTube was among them. The YouTube oEmbed endpoint could reflect JavaScript in a way that executed it.

Impact and fix

Once the attacker had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it through an image reference. The result was a shared link that could compromise another signed-in visitor. OpenAI fixed the hole and paid a $5,000 bounty; Simon Willison, who linked to the report, said he thought that amount was a bit cheap for a vulnerability this serious.

Sources: Simon Willison