Do the math: How we took over ChatGPT accounts

Opening a shared ChatGPT link can now expose your private conversations and account to takeover.

Researchers from Parameter Labs discovered a vulnerability in ChatGPT that allowed them to take over user accounts by sending a malicious link. The exploit leveraged ChatGPT's Preview feature for HTML and a graph visualization tool that incorporated the MathLive library. By crafting a shared ChatGPT conversation containing a malicious graph and an HTML Preview, attackers could trick the victim's browser into executing arbitrary JavaScript within the chatgpt.com domain. This script could access the victim's session, enumerate their private conversations, retrieve their content, and send it to an external server. The vulnerability allowed for full account takeover without requiring the victim to install any software or perform complex actions, beyond clicking a shared link. OpenAI has since patched the P1 severity issue.

This vulnerability highlights a critical security flaw in how platforms integrate external libraries and preview untrusted content, even within sandboxed environments. The exploit chain, involving the MathLive library's message handling and YouTube's oEmbed endpoint for bypassing Content Security Policy, demonstrates a complex but reproducible method for achieving arbitrary JavaScript execution within a trusted domain. The reliance on features like `srcdoc` and `postMessage` without rigorous origin validation created a pathway for attackers to leverage trusted components for malicious ends.

The ability to execute code as the logged-in user via a simple shared link has significant implications for data privacy and platform security. It suggests that even features designed for user convenience, like sharing conversations or previewing code, can become vectors for sophisticated attacks if not meticulously secured. Users will need to be far more cautious about the links they click, as the trust placed in shared content can now be exploited to compromise entire accounts.