They Hacked OpenAI With a Photo... #openai #hack #security
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: They Hacked OpenAI With a Photo… #openai #hack #security · Channel: Better Stack · 01:33 · Watch on YouTube
Topics: Cybersecurity and software security, Multimodal models
Summary
Section titled “Summary”Three researchers accessed OpenAI’s monorepo by exploiting a vulnerability in libheif, an image library used to decode HEIC files. Discourse passed uploaded HEIC images to the vulnerable parser, while a patch had not been marked as a security fix and was not backported to the Debian version in use. A misconfigured OpenAI single sign-on setup meant access to the help forum could lead to employee ChatGPT and Codex accounts, and one account was linked to OpenAI’s GitHub. The researchers received a $6,500 bounty, and the video warns developers to check the libheif versions used by their applications.
Key points
Section titled “Key points”- Three researchers got into OpenAI’s monorepo in under 72 hours.
- The vulnerability involved libheif, which decodes HEIC images.
- Discourse used ImageMagick and libheif to handle uploads that fastimage did not support.
- The exploited bug had been fixed upstream, but the change was not marked as a security fix or assigned a CVE.
- Debian did not backport the patch, leaving Discourse’s Debian 12-based Docker image with a vulnerable version.
- A misconfigured single sign-on setup meant forum access could lead to employee ChatGPT and Codex accounts.
- The researchers used an OpenAI GitHub-linked account to open a pull request as proof of access.
- OpenAI paid the researchers a $6,500 bounty.
- The video says libheif is also used beneath Slack, Meta, GitHub Enterprise, Rails, and Node frameworks such as Next.js.
- The closing advice is to check the libheif version when an application accepts HEIC or AVIF uploads.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | The image library behind the breach | The video introduces the researchers’ access to OpenAI’s monorepo and explains how HEIC uploads reached libheif through Discourse and ImageMagick. |
| 00:30 | A patch that did not reach the deployed version | The vulnerability had been fixed upstream, but without security-fix labeling or a CVE, Debian did not backport the patch to the version used by Discourse. |
| 01:01 | From forum access to employee accounts | A single sign-on misconfiguration connected forum takeover to employee accounts, and a GitHub-linked account was used to demonstrate access before the researchers stopped. |
| 01:33 | The wider risk of vulnerable dependencies | The video notes the library’s presence in other software and urges developers to check their libheif versions when accepting HEIC or AVIF uploads. |
Quotes
Section titled “Quotes”Three researchers got into OpenAI’s mono repo in under 72 hours. — 00:00
That means an attacker-controlled image can hit that parser directly. — 00:30
The forum used OpenAI’s own single sign-on. — 01:01
go check which version of libheif you’re running. — 01:33
Concepts and entities
Section titled “Concepts and entities”libheif, HEIC, AVIF, Discourse, fastimage, ImageMagick, OpenAI, Debian, ChatGPT, Codex, GitHub, SSO, CVE
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Three researchers got into OpenAI’s mono repo in under 72 hours. And the bug that got them there was an image library most of us have never even heard of. Let me explain. The library is called libheif. It decodes HEIC files, those types of photos that we end up taking on the iPhone. OpenAI’s community forum runs on Discourse, which normally checks uploaded images using a tool called fastimage. But fastimage, it doesn’t support HEIF. So when someone uploads
00:30 one of those images, it gets passed to ImageMagick, which then hands it straight to libheif. That means an attacker-controlled image can hit that parser directly. Now, here’s where it gets more interesting. The bug they exploited had actually been fixed upstream the year before. The problem was that commit was never actually marked as a security fix in the first place. It never got a CVE either, so Debian never backported the patch. And because Discourse’s Docker image is based on Debian 12, it was still shipping the vulnerable version. And
01:01 somehow this wasn’t even the worst part. The forum used OpenAI’s own single sign-on. And a misconfiguration there meant taking over the help forum could turn into taking over employees’ ChatGPT and Codex accounts. One of those accounts was connected to OpenAI’s GitHub, so they used it to open a pull request as proof that they were inside. Then they stopped. OpenAI ended up paying them a $6,500 bounty, and then they tried again elsewhere. Because libheif also sits underneath Slack, Meta, GitHub Enterprise, Rails, and Node frameworks like Next.js, they say
01:33 adapting this exploit to each of those companies took about a day or two. So if your app accepts HEIC or AVIF uploads, go check which version of libheif you’re running. Because a lot of times the weakest part of our code isn’t actually the code itself. It’s really all these libraries and packages that we have running underneath it. If you enjoy coding tips and tricks like this, be sure to subscribe to the Better Stack channel.