How We Took Over ChatGPT Accounts

Parameter Labs uncovered an exploit in ChatGPT's implementation of the artifacts pattern, an HTML preview feature. This vulnerability allowed untrusted code in an iframe to insert malicious HTML into the parent page. The problem stemmed from the MathLive JavaScript library's virtual keyboard, which could be triggered from the sandboxed iframe using postMessage().

The receiving code used innerHTML to process the message, enabling untrusted code to inject new HTML. Notably, innerHTML didn't directly execute script elements but could create a new iframe without sandbox restrictions. OpenAI's Content Security Policy (CSP) blocked inline scripts and limited script loading to specific domains, but the YouTube oEmbed endpoint could still be exploited to reflect and execute JavaScript.

Once the attacker gained JavaScript execution on ChatGPT, they could easily access private user data and exfiltrate it via an image reference. A shareable ChatGPT URL could, when clicked by another signed-in user, steal private data or carry out unauthorized actions. OpenAI patched the bug and compensated the researchers with a $5,000 bug bounty; however, the report considered this compensation insufficient for the severity of the vulnerability.