Discourse

Hacking OpenAI.

Authorized bug bounty research by Hacktron AI chained a heap buffer overflow in Discourse's HEIF image pipeline.

Right.

With an OpenAI SSO misconfiguration, the timeline from the first phone to find the retro proof was under 17, under 72 hours.

Um, and so same thing kind of happened here.

So here's what happens.

So you have this forum called Discourse.

And on those forums, you can upload images or avatars for your profile, for your character.

Uh, these three, uh, cyber bros from Ha- Hacktron, I think they're called.

They, they were doing basically research into image parsing, in particular the HEIF format, and they were basically going round to a bunch of sites and seeing, you know, if we upload these specially crafted image files, where's the parser running, and, and is it vulnerable to s- some of the attack classes they'd found here? And one of the th- uh, things they tested this on was a, uh, forum software called Discourse.

And, uh, sure enough, they found that Discourse has a bug where all other images that you upload are parsed by the, uh, I think the FastImage library.

But for some reason, if you upload an HEIF, it's parsed by ImageMagick, which uses LibHEIF, which has the bugs and vulnerabilities they were found- they were testing for.

Who runs Discourse to run their forums? None other than OpenAI.

So they deploy...

They basically use these vulnerabilities to, uh, pop remote code execution in OpenAI's forum instance of, uh, their Discourse forum, and were able to exfiltrate tokens.

Okay, so-

OpenAI confirmed a fix about 14 hours after the report, according to Hacktron, and on September 1st paid the team a $6,500 bounty.

OpenAI said the award, quote, 'recognizes the OpenAI side-finding, not the actions against Discourse,' which is the open source software that runs the forum.

Testing the forum itself was-"

That's the ones we use, by the way.

Any first or third-party service using the same sign-on could have granted the same access.

The way in was an image bug.

The forum runs on Discourse, and Discourse passes uploaded, uh, H-E-I-C and H-E-I-F, often verbalized as HEIF images, to a tool called ImageMagick, very popular- Oh, yeah ... uh, image rendering tool, which uses the LibHEIF library to read them.

A flaw in Live Heap, L- uh, LibHEIF let a specially crafted image- Uh ... corrupt the forum server's memory.

for sure.

So moving on, though, found another really interesting research post from the folks over at Hacktron, where they posted a write-up of a vulnerability report that they sent to OpenAI, as well as the forum software company Discourse.

They said while trying to find critical security vulnerabilities in different frontier AI companies, they discovered a single sign-on misconfiguration in OpenAI's identity infrastructure and a new remote code execution vulnerability in Discourse, which allowed them to take over the account of basically any OpenAI user, including OpenAI employees.

that participated in their community forums.

So basically, OpenAI allows you to sign into their community forums using your OpenAI account.

repositories, for example.

So this post is interesting.

It walks through their analysis, really focusing on the image upload pipeline for this forum software, Discourse.

They didn't do it, but they said, we saw that we could have had access.

One flaw they used was in an unpatched version of ImageMagick being used by a third-party message board called Discourse, which they chained to another flaw in OpenAI's own software.

They alerted Discourse, Discourse patched its flaw on July 27th, and OpenAI paid the team $6,500 for finding the bug in the OpenAI software.

Ooh, what are you going to do with all that money? I

don't know.