Security researcher discovered the ChatGPT vulnerability: Prompt word injection can bypass file access restrictions. Recently, security researcher zer0dac disclosed a security vulnerability in ChatGPT

Security researcher discovered ChatGPT vulnerability: Prompt word injection can bypass file access restrictions. Recently, security researcher zer0dac disclosed a security vulnerability in ChatGPT. This vulnerability allows attackers to bypass some file access restrictions through prompt injection and path traversal techniques to obtain unauthorized additional data. Currently, OpenAI has repaired the relevant mechanism after receiving the report. According to analysis, the core of the problem lies in ChatGPT’s processing process of uploaded files. Under normal circumstances, after the user uploads the file, the system does not provide a direct download function of the original file. If the user tries to request a download, the system usually reports that the file is temporary session content and cannot be extracted. However, zer0dac discovered a "bypass" path during testing: if the user first induces ChatGPT to edit the uploaded file, and then requests a download link on the grounds of "accidentally deleting the file", ChatGPT will generate a valid download URL. Through this link, the attacker can not only access the internal retrieval path, but also further use path traversal technology to try to break through permission restrictions and read file contents outside the target path. Although zer0dac pointed out that due to the existing sandbox mechanism of ChatGPT, the vulnerability itself cannot directly obtain highly sensitive data, but it is very likely to become a key link in the complex attack chain, providing the possibility for subsequent in-depth attacks. Currently, OpenAI has made targeted optimizations on this, adjusted the generation logic of file download URLs, and blocked the risk of exposure of this internal file path from the source. This incident also reminds developers once again that in the development of large-model applications, input filtering and permission isolation for user interaction are still the top priority for security protection. via AI News (author: AI Base)