Thread

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

491 points · 208 comments · Handy-Man

sergiotapia · 1789705226 · focus · HN ↗
They used a heif payload to get server access but they never describe the SSO flaw they used to actually get repo access (the juicy part!), bummer!
Wish they shared that interesting piece since that's the interesting part.
Also pretty shocking that openai uses github. I would have expected a company of that size with that much to lose would be using self hosted stuff.
1. carstonh · 1789705590 · focus · HN ↗
  agreed… why can an ID token for a separate client application be used to read and write to GitHub? that’s the story here.
  1. 6thbit · 1789761551 · focus · HN ↗
    since it was sso for their codex/chatgpt account, presumably they used an existing chatgpt github connector available to such accounts.
    Somehow the auth'd token for the forum was available within that VM, so having RCE they could've replayed it? idk

Unofficial Hacker News client; not affiliated with Y Combinator.