{"id":8390,"date":"2025-11-12T10:00:37","date_gmt":"2025-11-12T10:00:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/11\/12\/chatgpt-hacked-using-custom-gpts-exploiting-ssrf-vulnerability-to-expose-secrets\/"},"modified":"2025-11-12T10:00:37","modified_gmt":"2025-11-12T10:00:37","slug":"chatgpt-hacked-using-custom-gpts-exploiting-ssrf-vulnerability-to-expose-secrets","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/11\/12\/chatgpt-hacked-using-custom-gpts-exploiting-ssrf-vulnerability-to-expose-secrets\/","title":{"rendered":"ChatGPT Hacked Using Custom GPTs Exploiting SSRF Vulnerability to Expose Secrets"},"content":{"rendered":"

ChatGPT Hacked Using Custom GPTs Exploiting SSRF Vulnerability to Expose Secrets
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A Server-Side Request Forgery (SSRF) vulnerability in OpenAI\u2019s ChatGPT. The flaw, lurking in the Custom GPT \u201cActions\u201d feature, allowed attackers to trick the system into accessing internal cloud metadata, potentially exposing sensitive Azure credentials. <\/p>\n

The bug, discovered by Open Security during casual experimentation, highlights the risks of user-controlled URL handling in AI tools.<\/p>\n

SSRF vulnerabilities<\/a> occur when applications blindly fetch resources from user-supplied URLs, enabling attackers to coerce servers into querying unintended destinations. This can bypass firewalls, probe internal networks, or extract data from privileged services.<\/p>\n

As cloud adoption grows, SSRF\u2019s dangers amplify; major providers like AWS, Azure, and Google Cloud expose metadata endpoints, such as Azure\u2019s at http:\/\/169.254.169.254, which contain instance details and API tokens.<\/p>\n

The Open Web Application Security Project (OWASP) added SSRF to its Top 10 list in 2021, underscoring its prevalence in modern apps.<\/p>\n

The researcher, experimenting<\/a> with Custom GPTs, a premium ChatGPT Plus tool for building tailored AI assistants, noticed the \u201cActions\u201d section. This lets users define external APIs via OpenAPI schemas, allowing the GPT to call them for tasks like weather lookups.<\/p>\n

The interface includes a \u201cTest\u201d button to verify requests and supports authentication<\/a> headers. Spotting the potential for SSRF, the researcher tested by pointing the API URL to Azure\u2019s Instance Metadata Service (IMDS).<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n

Initial attempts failed because the feature enforced HTTPS URLs, while IMDS uses HTTP. Undeterred, the researcher bypassed this using a 302 redirect from an external HTTPS endpoint (via tools like ssrf.cvssadvisor.com) to the internal metadata URL. The server followed the redirect, but Azure blocked access without the \u201cMetadata: true\u201d header.<\/p>\n

Further probing revealed a workaround: the authentication settings allowed custom \u201cAPI keys.\u201d Naming one \u201cMetadata\u201d with value \u201ctrue\u201d injected the required header.<\/p>\n

Success! The GPT returned IMDS data, including an OAuth2 token for Azure\u2019s management API (requested via \/metadata\/identity\/oauth2\/token?resource=https:\/\/management.azure.com\/).<\/p>\n

This token granted direct access to OpenAI\u2019s cloud environment<\/a>, enabling resource enumeration or escalation.<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n

The impact was severe. In cloud setups, such tokens could pivot to full compromise, as seen in past Open Security pentests where SSRF led to remote code execution across hundreds of instances.<\/p>\n

For ChatGPT,<\/a> it risked leaking production secrets, though the researcher noted it wasn\u2019t the most catastrophic they\u2019d found.<\/p>\n

Reported promptly to OpenAI\u2019s Bugcrowd program, the vulnerability was assigned high severity and received a swift patch. OpenAI confirmed the fix, preventing further exploitation.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post ChatGPT Hacked Using Custom GPTs Exploiting SSRF Vulnerability to Expose Secrets<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

ChatGPT Hacked Using Custom GPTs Exploiting SSRF Vulnerability to Expose Secrets A Server-Side Request Forgery (SSRF) vulnerability in OpenAI\u2019s ChatGPT. The flaw, lurking in the Custom GPT \u201cActions\u201d feature, allowed attackers to trick the system into accessing internal cloud metadata, potentially exposing sensitive Azure credentials. The bug, discovered by Open Security during casual experimentation, highlights […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-8390","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8390"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8390"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8390\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}