A vulnerability enables prompt injection and phishing by exploiting ChatGPT’s implicit trust in Markdown links and image URLs that come from a third-party page it summarizes. The renderer auto-fetches attacker-controlled images and displays embedded links as live, clickable elements inside the trusted assistant interface. An attacker can append a payload to a web page that a victim later asks ChatGPT to summarize, causing leakage of IP, User-Agent, and Referer details when images are fetched. The attack can also render malicious Markdown links, display fake system-style security alerts, and serve a QR code from an attacker-controlled storage location to bypass desktop URL filters and enterprise controls. Summarization becomes an adversarial surface similar to earlier cross-prompt injection issues seen with email summarization.
"“The chatgpt.com response renderer trusts Markdown links and Markdown image URLs that originated from a third-party page the assistant has just summarized. It auto-fetches those images and surfaces those links as live, clickable elements inside the trusted assistant UI,” security researcher Andi Ahmeti said in a report shared with The Hacker News."
"In a hypothetical attack scenario, a bad actor can append a small payload to any web page that the victim later prompts ChatGPT to summarize, causing it to leak their IP, User-Agent, and Referer details when attacker-hosted images embedded in the page are automatically fetched when the answer is rendered."
"In addition, it can result in malicious Markdown links being rendered as live clickable elements inside the assistant's response, serve far fake system-style security alerts, and serve a QR code from an attacker's S3 bucket and trick the victim into scanning it via their mobile device, effectively bypassing desktop URL filters and enterprise security controls."
"What makes ChatGPhish a noteworthy attack technique is not the prompt injection itself, but in the manner in which the instructions embedded in a web page are followed and presented to the user as part of the summary. In other words, a regular web page summarized with ChatGPT is enough to render phishing lin"
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]