CyRC Vulnerability Advisory: CVE-2024-5184s prompt injection in EmailGPT service

Jun 04, 2024 / 1 min read

Table of Contents

Exploitation
Impact
Remediation
Discovery credit
About CVSS

Overview

The Black Duck Cybersecurity Research Center (CyRC) has exposed prompt injection vulnerabilities in the EmailGPT service. EmailGPT is an API service and Google Chrome extension that assists users in writing emails inside Gmail using OpenAI's GPT models.

The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts.

Exploitation

When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service.

Affected software

EmailGPT "main" branch

Impact

Exploitation of this vulnerability would lead to intellectual property leakage, denial-of-service, and direct financial loss through an attacker making repeated requests to the AI provider’s API which are pay-per-use.

CVSS Base Score: 6.5 (Medium)
CVSS 3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Remediation

The CyRC reached out to the developers but has not received a response within the 90-day timeline dictated by our responsible disclosure policy. The CyRC recommends removing the applications from networks immediately.

Discovery credit

This vulnerability was discovered by Mohammed Alshehri, a security researcher at Black Duck.

Timeline

February 26, 2024: Initial contact attempt
April 4, 2024: Second contact attempt
May 1, 2024: Final contact attempt
June 5, 2024: Advisory published by Black Duck

References

https://github.com/Coeeter/emailgpt

About CVSS

FIRST.Org, Inc (FIRST) is a non-profit organization based out of US that owns and manages CVSS. It is not required to be a member of FIRST to utilize or implement CVSS but FIRST does require any individual or organization give appropriate attribution while using CVSS. FIRST also states that any individual or organization that publishes scores follow the guideline so that anyone can understand how the score was calculated.