Parameter Labs 发现 ChatGPT 沙箱漏洞可窃取用户数据
How We Took Over ChatGPT Accounts
ChatGPT 核心交互组件的沙箱逃逸导致数据泄露，涉及 CSP 绕过与复杂攻击链，对 Agent 安全架构有重要警示意义。
How We Took Over ChatGPT Accounts
我们如何接管 ChatGPT 账户
Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas" but it looks like the latest revision is called HTML previews), where interactive custom HTML apps are displayed in a sandboxed iframe.
Parameter Labs 描述了他们对 ChatGPT 实现的 artifacts 模式（OpenAI 过去称之为 "Canvas"，但最新版本似乎称为 HTML previews）发现的漏洞，该模式在沙盒 iframe 中显示交互式自定义 HTML 应用。
It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data.
这些 HTML 必须严格沙盒化，以避免不受信任的代码与 OpenAI API 交互并访问私有数据，这一点至关重要。
Parameter found quite a complex attack chain. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard, which can be triggered in the parent page via postMessage() from the sandboxed iframe.
Parameter 发现了一个相当复杂的攻击链。OpenAI 在其图表支持中使用 MathLive JavaScript 库，该库包含自己的虚拟键盘，可以通过 postMessage() 从沙盒 iframe 在父页面中触发。
That message receiving code uses innerHTML, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.
该消息接收代码使用 innerHTML，因此任何发送消息的实体都可以向父页面添加自定义 HTML——并且没有机制阻止其他沙盒帧（包括 HTML 预览帧）调用该方法。
This meant untrusted code in an iframe could insert HTML, and while innerHTML doesn't directly execute script elements it could be used to inject a new iframe without sandbox restrictions.
这意味着 iframe 中的不受信任代码可以插入 HTML，虽然 innerHTML 不会直接执行 script 元素，但它可以用于注入一个没有沙盒限制的新 iframe。
OpenAI’s CSP rules blocked inline scripts entirely, and only allowed script loading from a handful of domains, but one of those was YouTube - and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way that executed it.
OpenAI 的 CSP 规则完全禁止内联脚本，仅允许从少数几个域加载脚本，但其中之一是 YouTube——而 YouTube oEmbed 端点可以用来以执行方式反射 JavaScript。
Once the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference.
一旦攻击者在 ChatGPT 上获得了 JavaScript 执行能力，通过 API 获取私有用户数据并通过图像引用将其外泄就易如反掌。
The end result: you could create a ChatGPT share URL which, when visited by another signed-in user, could exfiltrate their private data or take actions on their behalf.
最终结果：你可以创建一个 ChatGPT 分享 URL，当另一个已登录用户访问时，该 URL 可以外泄其私有数据或代表其采取行动。
OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious.
OpenAI 修补了该漏洞并支付了 5,000 美元的漏洞赏金，我认为对于如此严重的漏洞来说，这笔钱有点少。
Via Hacker News
来源：Hacker News
Tags: iframes, javascript, sandboxing, security, xss, openai, chatgpt, content-security-policy
标签：iframes, javascript, sandboxing, security, xss, openai, chatgpt, content-security-policy
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力