ChatGPT Plugin Flaw – attackers could access private GitHub repos of others

Posted by MorL on Friday March 15, 2024 @09:18AM
from the scmagazine.com dept.

https://www.scmagazine.com/news/chatgpt-0-click-plugin-exploit-risked-leak-of-private-github-repos

( 2 comments | 5 points | on HN )

Re:ChatGPT Plugin Flaw – attackers could access private GitH... by aviCC on Friday March 15, 2024 @09:28AM (#39715235)

Technical details: "The plugin does not authenticate the request, which means that the attacker can insert another memberId (aka the victim) and get a code that represents the victim. With that code, he can use ChatGPT and access the GitHub of the victim."

[ Parent | on HN ]

Re:ChatGPT Plugin Flaw – attackers could access private GitH... by aviCC on Friday March 15, 2024 @09:29AM (#39715238)

And a link, if you want to read the official blog post: https://salt.security/blog/security-flaws-within-chatgpt-ext...

[ Parent | on HN ]