/
← Voltar ao feed
high technology artificial intelligence

Hacktron chains libheif RCE in Discourse with OpenAI SSO flaw to take over OpenAI employee ChatGPT/Codex accounts

1 fonte(s) · 1 atualização(ões) · publicado 12/09/2026 21:00 · coletado há 4 dias

On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensitive data, they used an employee's Codex, which was connected to GitHub, to open a harmless PR in OpenAI's internal monorepo. The exploit was developed with Claude Opus models in under 72 hours. OpenAI fixed its side in about 14 hours and paid a $6,500 bounty, and Discourse published advisory GHSA-vhm9-85gw-x335. Hacktron says the wider HEIF Heist research found libheif-related exposure in other major platforms, including Slack, Meta and GitHub Enterprise, and that only Shopify noticed the activity.

Detalhes técnicos

  • Discourse passed HEIC/HEIF files to ImageMagick's magick command because FastImage did not support HEIF, which exposed libheif to attacker-controlled files.
  • Debian 12 shipped libheif 1.19.7 and Debian 13 shipped 1.19.8. Both lacked an upstream fix that was never flagged as a security fix and has no CVE. Debian published a fix for Debian 13 on August 8, 2026 (DSA-6417-1).
  • The bug gave out-of-bounds read/write primitives during HEIC decoding. Opus 4.8 produced an exploit with ASLR disabled. Opus 5 then produced a reliable x86-64/jemalloc exploit with ASLR enabled.
  • An autonomous agent loop reached RCE on a Discourse Cloud test instance, and the same script was then used against OpenAI's forum.
  • The escalation to ChatGPT/Codex stems from the OpenAI SSO ("Sign in with OpenAI" via auth.openai.com). Any compromised first- or third-party service using that SSO would give the same access.
  • OpenAI's bounty excluded testing against the Discourse-hosted forum and rewarded only the OpenAI-side finding.

Remediação

  • Self-hosted Discourse: run git pull and ./launcher rebuild app from /var/discourse, because a web-interface update alone may not replace the vulnerable image.
  • Install the latest security-patched libheif and libde265 packages (upstream libheif v1.23.4 as of Sept 14, 2026) and check distribution advisories for backports.
  • Disable untrusted HEIF/AVIF decoding where it is not needed, restrict formats via the ImageMagick security policy, and isolate image processing in hardened, ephemeral sandboxes.

Linha do tempo

  1. hacktron.ai ↗ · pub. 12/09/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Hacktron chains libheif RCE in Discourse with OpenAI SSO flaw to take over OpenAI employee ChatGPT/Codex accounts

    ler a análise desta fonte

    On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensitive data, they used an employee's Codex, which was connected to GitHub, to open a harmless PR in OpenAI's internal monorepo. The exploit was developed with Claude Opus models in under 72 hours. OpenAI fixed its side in about 14 hours and paid a $6,500 bounty, and Discourse published advisory GHSA-vhm9-85gw-x335. Hacktron says the wider HEIF Heist research found libheif-related exposure in other major platforms, including Slack, Meta and GitHub Enterprise, and that only Shopify noticed the activity.

    Technical Details

    • Discourse passed HEIC/HEIF files to ImageMagick's magick command because FastImage did not support HEIF, which exposed libheif to attacker-controlled files.
    • Debian 12 shipped libheif 1.19.7 and Debian 13 shipped 1.19.8. Both lacked an upstream fix that was never flagged as a security fix and has no CVE. Debian published a fix for Debian 13 on August 8, 2026 (DSA-6417-1).
    • The bug gave out-of-bounds read/write primitives during HEIC decoding. Opus 4.8 produced an exploit with ASLR disabled. Opus 5 then produced a reliable x86-64/jemalloc exploit with ASLR enabled.
    • An autonomous agent loop reached RCE on a Discourse Cloud test instance, and the same script was then used against OpenAI's forum.
    • The escalation to ChatGPT/Codex stems from the OpenAI SSO ("Sign in with OpenAI" via auth.openai.com). Any compromised first- or third-party service using that SSO would give the same access.
    • OpenAI's bounty excluded testing against the Discourse-hosted forum and rewarded only the OpenAI-side finding.

    Remediation

    • Self-hosted Discourse: run git pull and ./launcher rebuild app from /var/discourse, because a web-interface update alone may not replace the vulnerable image.
    • Install the latest security-patched libheif and libde265 packages (upstream libheif v1.23.4 as of Sept 14, 2026) and check distribution advisories for backports.
    • Disable untrusted HEIF/AVIF decoding where it is not needed, restrict formats via the ImageMagick security policy, and isolate image processing in hardened, ephemeral sandboxes.