Chanzhaoyu chatgpt-web cross site scripting

Successful exploitation of CVE-2023-7215 allows an attacker to inject arbitrary JavaScript code into the chatgpt-web application. This can lead to a variety of malicious actions, including session hijacking, stealing sensitive user data (such as API keys or authentication tokens), and defacing the application. The attacker could potentially redirect users to phishing sites or install malware. The impact is primarily limited to the user's browser session, but the consequences can be severe depending on the sensitivity of the data accessed within that session.

Users of chatgpt-web version 2.11.1 are at immediate risk. Specifically, those who rely on the Description parameter for user input or content display are particularly vulnerable. Shared hosting environments where multiple users share the same chatgpt-web instance are also at increased risk, as an attacker could potentially compromise the entire instance.

• javascript / web: Inspect network traffic for requests containing JavaScript code in the Description parameter. Look for patterns like <script> tags or onerror event handlers.

// Example: Check for script tags in the Description parameter
if (description.includes('<script>') {
  console.warn('Potential XSS vulnerability detected');
}

• generic web: Examine access and error logs for unusual activity related to the Description parameter. Look for requests containing suspicious characters or patterns.

# Example: grep for script tags in access logs
grep 'Description=<script>' access.log

1. 2024-01-08Disclosure

   disclosure

2. 2024-01-08Patch

   patch

1. Réservé2024-01-05
2. Publiée2024-01-08
3. Modifiée2025-06-03
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2023-7215 is to upgrade to version 2.11.2 of chatgpt-web, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing input validation and sanitization on the Description parameter to prevent the injection of malicious code. While not a complete solution, this can reduce the attack surface. Review and update any existing web application firewalls (WAFs) to block requests containing suspicious JavaScript payloads in the Description parameter. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload (e.g., <script>alert('XSS')</script>) through the Description parameter and verifying that it does not execute.