I think this is a bad look for OpenAI. Their log viewer should not be rendering Markdown images in a way that can leak data to third parties, and closing this report as "not applicable" mainly tells me that their triage process for BugCrowd is flawed and decisions are being made there by people who don't understand the consequences of this kind of bug.
OpenAI API Logs: Unpatched data exfiltration
11–17 of 17 posts
Re: OpenAI API Logs: Unpatched data exfiltration
#12This appears to be a marketing piece for PromptArmor. If you look at the left sidebar of the article, they list other recent posts and highlight which ones ranked #1 on HN. I can see how OpenAI would not be terribly interested in this issue, since it's a pretty obscure/unlikely one but not out of the realm of reason. It basically can be summarized as "The OpenAI log viewer processes Markdown, including loading images…
Stored XSS should be a priority one fix for any company and result in an instant bug payout.
This isn't quite a stored XSS - the attacker can't execute JavaScript - but it's a similar shape and can be used to exfiltrate data. That's bad!
Re: OpenAI API Logs: Unpatched data exfiltration
#13This appears to be a marketing piece for PromptArmor. If you look at the left sidebar of the article, they list other recent posts and highlight which ones ranked #1 on HN. I can see how OpenAI would not be terribly interested in this issue, since it's a pretty obscure/unlikely one but not out of the realm of reason. It basically can be summarized as "The OpenAI log viewer processes Markdown, including loading images…
I found the tone in the article annoying, but my skim reading was that it is an actual vulnerability. The screenshot from OpenAI loads an image from a third-party site and the URL of the image might have all sorts of details etc.
I think the viewer should have some CSP policy in place to not do that.
That being said, if it was closed as "Not Applicable" it gives me a bit of reason to wonder if some crucial details about the whole chain was either not articulated or mentioned by PromptArmor. Maybe for other reasons it is not actually reasonable to put that on OpenAI site. I'm not sure on the spot. But on a skim read it looks like a legit vulnerability from OpenAI's part that they should fix.
I really wish PromptArmor just opened with "OpenAI's log viewer page lacks CSP policies, so it can load arbitrary URL images and here is an example how such things can easily end up on that page". This was really annoying to read but I kept going because I was curious was it a legit thing or not...
Edit: I don't know if the article was edited just now but there is a clarification paragraph that actually makes it a bit more clear. PromptArmor if you are reading this, I wonder if my gut reaction of being skeptical simply because of the tone and presentation is a common thing and there are ways to both be convincing right at the start of an article, but still allowing yourself to be marketing-like. I probably would have started with a paragraph that dryly describes exactly the vulnerability "OpenAI's Log viewer is not secure against maliciously crafted logs, which can result in data exfiltration. On this page, we show a realistic scenario by which a malicious third-party can sneak in an image URL to this page and exfiltrate data." and then go on with the rest of the article.
Re: OpenAI API Logs: Unpatched data exfiltration
#14This appears to be a marketing piece for PromptArmor. If you look at the left sidebar of the article, they list other recent posts and highlight which ones ranked #1 on HN. I can see how OpenAI would not be terribly interested in this issue, since it's a pretty obscure/unlikely one but not out of the realm of reason. It basically can be summarized as "The OpenAI log viewer processes Markdown, including loading images…
I found the tone in the article annoying, but my skim reading was that it is an actual vulnerability. The screenshot from OpenAI loads an image from a third-party site and the URL of the image might have all sorts of details etc. I think the viewer should have some CSP policy in place to not do that. That being said, if it was closed as "Not Applicable" it gives me a bit of reason to wonder if some crucial details ab…
The post itself is pretty comprehensive. I'm not sure they need to pinpoint the exact attack surface in the TLDR, but your version isn't exactly correct as they point out three mitigations and only one of them is a CSP policy for the API Log viewer.
Re: OpenAI API Logs: Unpatched data exfiltration
#15I really do not understand why a log viewer needs to render markdown images by default since that defeats the purpose of reading raw logs. It seems like a massive oversight to let a debugging tool make network requests to arbitrary domains just to show a picture. I just want to read the text output without worrying about my admin panel leaking data.
Re: OpenAI API Logs: Unpatched data exfiltration
#16Earlier quoted context omitted.
I found the tone in the article annoying, but my skim reading was that it is an actual vulnerability. The screenshot from OpenAI loads an image from a third-party site and the URL of the image might have all sorts of details etc. I think the viewer should have some CSP policy in place to not do that. That being said, if it was closed as "Not Applicable" it gives me a bit of reason to wonder if some crucial details ab…
The post itself is pretty comprehensive. I'm not sure they need to pinpoint the exact attack surface in the TLDR, but your version isn't exactly correct as they point out three mitigations and only one of them is a CSP policy for the API Log viewer.
Yeah I agree. I think even if you block CSP images, attacker could still hide information, or attempted exfiltration.
The post got me now instead wondering how to not make people shallowly dismiss perfectly fine articles for dumb reasons, like I almost did. It's not even that unclear what the attack is, in the article's its opening when I look at it now again, and I now went around their posts to see how PromptArmor generally does their writing because I got curious about the writing part...
I've seen in the past vulnerabilities that were way overblown but hyped up, so this made me notice how that armor has made me be skeptical whenever some article like this feels it combines marketing + vulnerability reporting.
Re: OpenAI API Logs: Unpatched data exfiltration
#17I think this is a bad look for OpenAI. Their log viewer should not be rendering Markdown images in a way that can leak data to third parties, and closing this report as "not applicable" mainly tells me that their triage process for BugCrowd is flawed and decisions are being made there by people who don't understand the consequences of this kind of bug.
Agreed.
In December I reported a data exfil in OpenAI Agent Builder and it was also closed as Not Applicable, so it's probably still there.
It's also unclear if anyone from OpenAI even ever saw the report. I don't know.
Maybe the incentives are off on some bug bounty platforms or programs, and triagers are evaluated on how fast they respond, and how quickly a ticket is closed rather then what kind of quality tickets they help produce.
It's the only explanation I have for this kind of decisions.