The Synopsys Cybersecurity Research Center (CyRC) has exposed prompt injection vulnerabilities in the EmailGPT service. EmailGPT is an API service and Google Chrome extension that assist users in writing emails inside Gmail using OpenAI’s GPT models.
The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts.
Exploitation
When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service.
Affected Software
- EmailGPT “main” branch
Impact
Exploitation of this vulnerability would lead to intellectual property leakage, denial-of-service, and direct financial loss through an attacker making repeated requests to the AI provider’s API which are pay-per-use.
- CVSS Base Score: 6.5 (Medium)
- CVSS 3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/
S:U/C:H/I:N/A:N
Remediation
The CyRC reached out to the developers but has not received a response within the 90-day timeline dictated by our responsible disclosure policy. The CyRC recommends removing the applications from networks immediately.
Discovery Credit
This vulnerability was discovered by Mohammed Alshehri, a security researcher at Synopsys.
Timeline
February 26, 2024: Initial contact attempt
April 4, 2024: Second contact attempt
May 1, 2024: Final contact attempt
June 5, 2024: Advisory published by Synopsys
References
https://github.com/Coeeter/
About CVSS
FIRST.Org, Inc (FIRST) is a non-profit organisation based out of US that owns and manages CVSS. It is not required to be a member of FIRST to utilise or implement CVSS but FIRST does require any individual or organisation give appropriate attribution while using CVSS. FIRST also states that any individual or organisation that publishes scores follow the guideline so that anyone can understand how the score was calculated.
