Forscher zeigen Account-Übernahme bei ChatGPT über Sandbox-Escape
Parameter Labs haben eine Angriffskette beschrieben, die über einen öffentlichen ChatGPT-Freigabe-Link bösartiges JavaScript in der angemeldeten Sitzung des Opfers ausführt. Grundlage war eine Schwachstelle in der HTML-Vorschau.
The chain combined features that looked harmless on their own. ChatGPT renders model-authored HTML in a Preview running inside a sandboxed iframe on a separate web address, and the researchers confirmed the sandbox itself held — Preview code could not read the main page. But the same conversation could also contain an interactive graph, and that graph loads MathLive, a math-input library, into the main chatgpt.com page. MathLive installs a listener for postMessage events that control its on-screen keyboard. That listener accepted messages from any sender with no origin check, treated the keyboard layout field as HTML and rendered it via innerHTML in the trusted page.
How it works in practice: the failure lived in the seam between components, not inside any single one — the sandbox held, the CSP was in place and MathLive is a legitimate library. Teams building artifact previews, chart widgets or connector UIs should audit every postMessage listener installed in their top-level page, verify both event origin and event source before accepting state-changing messages, keep dynamically created frames sandboxed along the whole rendering path, and treat any CSP allowlist entry for a third-party script endpoint as a potential execution path. For anyone shipping agent or preview features the checklist is concrete — authenticate every cross-frame message, sandbox untrusted markup end to end, and measure same-origin script impact in the victim's authenticated context.
Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky