Dev.to tutorial Tutorials Oct 31 1 views

We took over ChatGPT accounts: the MathLive postMessage chain, and the 20-line audit for your own listeners

by Sam LABBE

A shared ChatGPT link, a math keyboard library listening to any sender, an iframe that inherits chatgpt.com, a CSP bypass through YouTube's oembed, and the session token: full account takeover, fixed Oct 26, $5k bounty. The attack chain step by step, and a static audit I ran against the vulnerable library itself: 4 listeners, zero sender checks.

Read Original
OpenAI

Metadata

Devto Id
4952202
Positive Reactions Count
5
Reading Time Minutes
6

Related

Dev.to tutorial 29m ago

Can you merge at agent speed?

Major League Hacking and Entire are teaming up for a year of hackathons, DEV Challenges, and a new...

25