10 ms·

Haha, this would be an amazing way to test the ChatGPT crawler reflective DDOS vulnerability [1] I published last week. Basically a single HTTP Request to Chat

Haha, this would be an amazing way to test the ChatGPT crawler reflective DDOS vulnerability [1] I published last week. Basically a single HTTP Request to ChatGPT API can trigger 5000 HTTP requests by ChatGPT crawler to a website. The vulnerability is/was thoroughly ignored by OpenAI/Microsoft/BugCrowd but I really wonder what would happen when ChatGPT crawler interacts with this tarpit several times per second. As ChatGPT crawler is using various Azure IP ranges I actually think the tarpit would crash first. The vulnerability reporting experience with OpenAI / BugCrowd was really horrific. It's always difficult to get attention for DOS/DDOS vulnerabilities and companies always act like they are not a problem. But if their system goes dark and the CEO calls then suddenly they accept it as a security vulnerability. I spent a week trying to reach OpenAI/Microsoft to get this fixed, but I gave up and just published the writeup. I don't recommend you to exploit this vulnerability due to legal reasons. [1] https://github.com/bf/security-advisories/blob/main/2025-01-ChatGPT-Crawler-Reflective-DDOS-Vulnerability.md https://github.com/bf/security-advisories/blob/main/2025-01-...

JohnMakin 2y ago
Nice find, I think one of my sites actually got recently hit by something like this. And yea, this kind of thing should be trivially preventable if they cared at all.
- dewey 2y ago
  > And yea, this kind of thing should be trivially preventable if they cared at all. Most of the time when someone says something is "trivial" without knowing anything about the internals, it's never trivial. As someone working close to the b2c side of a business, I can’t count the amount of times I've heard that something should be trivial while it's something we've thought about for years.
  - grahamj 2y ago
    If you’re unable to throttle your own outgoing requests you shouldn’t be making any
    - bflesch 2y ago
      I assume it'll be hard for them to notice because it's all coming from Azure IP ranges. OpenAI has very big credit card behind this Azure account so this vulnerability might only be limited by Azure capacity. I noticed they switched their crawler to new IP ranges several times, but unfortunately Microsoft CERT / Azure security team didn't answer to my reports. If this vulnerability is exploited, it hits your server with MANY requests per second, right from the hearts of Azure cloud.
      - grahamj 2y ago
        Note I said outgoing, as in the crawlers should be throttling themselves
        bflesch 2y ago
        Sorry for misunderstanding your point. I agree it should be throttled. Maybe they don't need to throttle because they don't care about cost. Funny thing is that servers from AWS were trying to connect to my system when I played around with this - I assume OpenAI has not moved away from AWS yet. Also many different security scanners hitting my IP after every burst of incoming requests from the ChatGPT crawler Azure IP ranges. Quite interesting to see that there are some proper network admins out there.
        grahamj 2y ago
        yeah it’s fun out on the wild internet! Thankfully I don’t manage something thing crawlable anymore but even so the endpoint traffic is pretty entertaining sometimes. What would keep me up at night if I was still more on the ops side is “computer use” AI that’s virtually indistinguishable from a human with a browser. How do you keep the junk away then?
        jillyboel 2y ago
        They need to throttle because otherwise they're simply a DDoS service. It's clear they don't give a fuck though, like any bigtech company. They'll spend millions on prosecuting anyone who dares to do what they perceive as a DoS attack against them, but they'll spit in your face and laugh at you if you even dare to claim they are DDoSing you.
  - bflesch 2y ago
    The technical flaws are quite trivial to spot, if you have the relevant experience: - urls[] parameter has no size limit - urls[] parameter is not deduplicated (but their cache is deduplicating, so this security control was there at some point but is ineffective now) - their requests to same website / DNS / victim IP address rotate through all available Azure IPs, which gives them risk of being blocked by other hosters. They should come from the same IP address. I noticed them changing to other Azure IP ranges several times, most likely because they got blocked/rate limited by Hetzner or other counterparties from which I was playing around with this vulnerabilities. But if their team is too limited to recognize security risks, there is nothing one can do. Maybe they were occupied last week with the office gossip around the sexual assault lawsuit against Sam Altman. Maybe they still had holidays or there was another, higher-risk security vulnerability. Having interacted with several bug bounties in the past, it feels OpenAI is not very mature in that regard. Also why do they choose BugCrowd when HackerOne is much better in my experience.
    - fc417fc802 2y ago
      > rotate through all available Azure IPs, ... They should come from the same IP address. I would guess that this is intentional, intended to prevent IP level blocks from being effective. That way blocking them means blocking all of Azure. Too much collateral damage to be worth it.
      - jackcviers3 2y ago
        It is. There are scraping third party services you can pay for that will do all of this for you, and getting blocked by IP. You then make your request to the third-party scraper, receive the contents, and do with them whatever you need to do.
  - deleted 2y ago
    [deleted]
  - jillyboel 2y ago
    now try to reply to the actual content instead of some generalizing grandstanding bullshit
- zanderwohl 2y ago
  IDK, I feel that if you're doing 5000 HTTP calls to another website it's kind of good manners to fix that. But OpenAI has never cared about the public commons.
  - marginalia_nu 2y ago
    Yeah, even beyond common decency, there's pretty strong incentives to fix it, as it's a fantastic way of having your bot's fingerprint end up on Cloudflare's shitlist.
    - bflesch 2y ago
      Kinda disappointed by cloudflare - it feels they have quite basic logic only. Why would anomaly detection not capture these large payloads? There was a zip-bomb like attack a year ago where you could send one gigabyte of the letter "A" compressed into very small filesize with brotli via cloudflare to backend servers, basically something like the old HTTP Transfer-Encoding (which has been discontinued). Attacker --1kb--> Cloudflare --1GB--> backend server Obviously the servers who received the extracted HTTP request from the cloudflare web proxies were getting killed but cloudflare didn't even accept it as a valid security problem. AFAIK there was no magic AI security monitoring anomaly detection thing which blocked anything. Sometimes I'd love to see the old web application firewall warnings for single and double quotes just to see if the thing is still there. But maybe it's misconfiguration on side of cloudflare user because I can remember they at least had a WAF product in the past.
      - benregenspan 2y ago
        > But maybe it's misconfiguration on side of cloudflare user because I can remember they at least had a WAF product in the past They still have a WAF product, though I don't think anything in the standard managed ruleset will fire just on quotes, the SQLi and XSS checks are a bit more sophisticated than that. From personal experience, they will fire a lot if someone uses a WAF-protected CMS to write a post about SQL.
  - chefandy 2y ago
michaelbuckbee 2y ago
What is the https://chatgpt.com/backend-api/attributions https://chatgpt.com/backend-api/attributions endpoint doing (or responsible for when not crushing websites).
- bflesch 2y ago
  When ChatGPT cites web sources in it's output to the user, it will call `backend-api/attributions` with the URL and the API will return what the website is about. Basically it does HTTP request to fetch HTML `<title/>` tag. They don't check length of supplied `urls[]` array and also don't check if it contains the same URL over and over again (with minor variations). It's just bad engineering all around.
  - JohnMakin 2y ago
    Even if you were unwilling to change this behavior on the application layer or server side, you could add a directive in the proxy to prevent such large payloads from being accepted as an immediate mitigation step, unless they seriously need that parameter to have unlimited number of urls in it (guessing they have it set to some default like 2mb and it will break at some limit, but I am afraid to play with this too much). Somehow I doubt they need that? I don't know though.
    - bflesch 2y ago
      Cloudflare is proxy in front of the API endpoint. After it became apparent that BugCrowd is tarpitting me and OpenAI didn't care to respond, I reported to Cloudflare via their bug bounty because I thought it's such a famous customer they'd forward the information. But yeah, cloudflare did not forward the vulnerability to openai or prevent these large requests at all.
      - JohnMakin 2y ago
        I mean, whatever proxy is directly in front of their backend. I don't pretend to know how it's set up, but something like nginx could nip this in the bud pretty quickly as an emergency mediation, was my point.
hassleblad23 2y ago
I am not surprised that OpenAI is not interested if fixing this.
- bflesch 2y ago
  Their security.txt email address replies and asks you to go on BugCrowd. BugCrowd staff is unwilling (or too incompetent) to run a bash curl command to reproduce the issue, while also refusing to forward it to OpenAI. The support@openai.com waits an hour before answering with ChatGPT answer. Issues raised on GitHub directly towards their engineers were not answered. Also Microsoft CERT & Azure security team do not reply or care respond to such things (maybe due to lack of demonstrated impact).
  - permo-w 2y ago
    why try this hard for a private company that doesn't employ you?
    - inetknght 2y ago
      Some people have passion.
    - myself248 2y ago
      Maybe it's wrecking a site they maintain or care about.
    - deleted 2y ago
      [deleted]
    - bflesch 2y ago
      Ego, curiosity, potential bug bounty & this was a low hanging fruit: I was just watching API request in Devtools while using ChatGPT. It took 10 minutes to spot it, and a week of trying to reach a human being. Iterating on the proof-of-concept code to increase potency is also a nice hobby. These kinds of vulnerabilities give you good idea if there could be more to find, and if their bug bounty program actually is worth interacting with. With this code smell I'm confident there's much more to find, and for a Microsoft company they're apparently not leveraging any of their security experts to monitor their traffic.
soupfordummies 2y ago
Try it and let us know :)
dangoodmanUT 2y ago
has anyone tested this working? I get a 301 in my terminal trying to send a request to my site
- bflesch 2y ago
  Hopefully they'd have it fixed by now. The magic of HN exposure...
mitjam 2y ago
How can it reach localhost or is this only a placeholder for a real address?
- bflesch 2y ago
  The code in the github repo has some errors to prevent script kiddies from directly copy/pasting it. Obviously the proof-of-concept shared with OpenAI/BugCrowd didn't have such errors.
  - mitjam 2y ago
    Ah ok, thanks, that makes sense. Btw the ChatGPT Web App (haven’t tested with the Desktop App) can find info from local/private sites with the search tool, i assume they browse with a client side function.
    - bflesch 2y ago
      Yeah I first wanted to use this bug to scan their IP ranges and figure out their internal network (e.g. make requests to 10.0.0.1, 10.0.0.2, and so on). But then I realized that it will hallucinate an answer for every IP it is given :) So it would just come up with titles of random router admin panel websites.
andai 2y ago
Is 5000 a lot? I'm out of the loop but I thought c10k was solved decades ago? Or is it about the "burstiness" of it? (That all the requests come in simultaneously -- probably SSL code would be the bottleneck.)
- hombre_fatal 2y ago
  c10k is about efficiently scheduling socket connections. it doesn’t make sense in this context nor is it the same as 10k rps.
- bflesch 2y ago
  I'm not a DDOS expert and didn't test out the limits due to potential harm to OpenAI. Based on my experience I recognized it as potential security risk and framed it as DDOS because there's a big amplification factor: 1 API request via Cloudflare -> 5000 incoming requests from OpenAI - their requests come in simultaneously from different ips - each request downloads up to 10mb of random data (tested with multi-gb file) - the requests come from different azure IP ranges, either bc they kept switching them or bc of different geolocations. - if you block them on the firewall their requests still hammer your server (it's not like the first request notices it can't establish connection and then the next request TO SAME IP would stop) I tried to get it recognized and fixed, and now apparently HN did its magic because they've disabled the API :) Previously, their engineers might have argued that this is a feature and not a bug. But now that they have disabled it, it shows that this clearly isn't intended behavior.
smokel 2y ago
Am I correct in understanding that you waited at most one week for a reply? In my experience with large companies, that's rather short. Some nudging may be required every now and then, but expecting a response so fast seems slightly unreasonable to me.
nurettin 2y ago
They don't care. You are just raising their costs which they will in return charge their customers.
anthony42c 2y ago
Where does the 5000 HTTP request limit come from? Is that the limit of the URLs array? I was curious to learn more about the endpoint, but can't find any online API docs. The docs ChatGPT suggests are defined for api.openapi.com, rather than chatgpt.com/backend-api. I wonder if its reasonable (from a functional perspective) for the attributions endpoint not to place a limit on the number of urls used for attribution. I guess potentially ChatGPT could reference hundreds of sites and thousands of web pages in searching for a complex question that covered a range of different interrelated topics? Or do I misunderstand the intended usage of that endpoint?
deleted 2y ago
[deleted]
pabs3 2y ago
Could those 5000 HTTP requests be made to go back to the ChatGPT API?

JohnMakin 2y ago

Nice find, I think one of my sites actually got recently hit by something like this. And yea, this kind of thing should be trivially preventable if they cared at all.

dewey 2y ago
> And yea, this kind of thing should be trivially preventable if they cared at all. Most of the time when someone says something is "trivial" without knowing anything about the internals, it's never trivial. As someone working close to the b2c side of a business, I can’t count the amount of times I've heard that something should be trivial while it's something we've thought about for years.
- grahamj 2y ago
  If you’re unable to throttle your own outgoing requests you shouldn’t be making any
  - bflesch 2y ago
    I assume it'll be hard for them to notice because it's all coming from Azure IP ranges. OpenAI has very big credit card behind this Azure account so this vulnerability might only be limited by Azure capacity. I noticed they switched their crawler to new IP ranges several times, but unfortunately Microsoft CERT / Azure security team didn't answer to my reports. If this vulnerability is exploited, it hits your server with MANY requests per second, right from the hearts of Azure cloud.
    - grahamj 2y ago
      Note I said outgoing, as in the crawlers should be throttling themselves
      - bflesch 2y ago
        Sorry for misunderstanding your point. I agree it should be throttled. Maybe they don't need to throttle because they don't care about cost. Funny thing is that servers from AWS were trying to connect to my system when I played around with this - I assume OpenAI has not moved away from AWS yet. Also many different security scanners hitting my IP after every burst of incoming requests from the ChatGPT crawler Azure IP ranges. Quite interesting to see that there are some proper network admins out there.
        grahamj 2y ago
        yeah it’s fun out on the wild internet! Thankfully I don’t manage something thing crawlable anymore but even so the endpoint traffic is pretty entertaining sometimes. What would keep me up at night if I was still more on the ops side is “computer use” AI that’s virtually indistinguishable from a human with a browser. How do you keep the junk away then?
        jillyboel 2y ago
        They need to throttle because otherwise they're simply a DDoS service. It's clear they don't give a fuck though, like any bigtech company. They'll spend millions on prosecuting anyone who dares to do what they perceive as a DoS attack against them, but they'll spit in your face and laugh at you if you even dare to claim they are DDoSing you.
- bflesch 2y ago
  The technical flaws are quite trivial to spot, if you have the relevant experience: - urls[] parameter has no size limit - urls[] parameter is not deduplicated (but their cache is deduplicating, so this security control was there at some point but is ineffective now) - their requests to same website / DNS / victim IP address rotate through all available Azure IPs, which gives them risk of being blocked by other hosters. They should come from the same IP address. I noticed them changing to other Azure IP ranges several times, most likely because they got blocked/rate limited by Hetzner or other counterparties from which I was playing around with this vulnerabilities. But if their team is too limited to recognize security risks, there is nothing one can do. Maybe they were occupied last week with the office gossip around the sexual assault lawsuit against Sam Altman. Maybe they still had holidays or there was another, higher-risk security vulnerability. Having interacted with several bug bounties in the past, it feels OpenAI is not very mature in that regard. Also why do they choose BugCrowd when HackerOne is much better in my experience.
  - fc417fc802 2y ago
    > rotate through all available Azure IPs, ... They should come from the same IP address. I would guess that this is intentional, intended to prevent IP level blocks from being effective. That way blocking them means blocking all of Azure. Too much collateral damage to be worth it.
    - jackcviers3 2y ago
      It is. There are scraping third party services you can pay for that will do all of this for you, and getting blocked by IP. You then make your request to the third-party scraper, receive the contents, and do with them whatever you need to do.
- deleted 2y ago
  [deleted]
- jillyboel 2y ago
  now try to reply to the actual content instead of some generalizing grandstanding bullshit
zanderwohl 2y ago
IDK, I feel that if you're doing 5000 HTTP calls to another website it's kind of good manners to fix that. But OpenAI has never cared about the public commons.
- marginalia_nu 2y ago
  Yeah, even beyond common decency, there's pretty strong incentives to fix it, as it's a fantastic way of having your bot's fingerprint end up on Cloudflare's shitlist.
  - bflesch 2y ago
    Kinda disappointed by cloudflare - it feels they have quite basic logic only. Why would anomaly detection not capture these large payloads? There was a zip-bomb like attack a year ago where you could send one gigabyte of the letter "A" compressed into very small filesize with brotli via cloudflare to backend servers, basically something like the old HTTP Transfer-Encoding (which has been discontinued). Attacker --1kb--> Cloudflare --1GB--> backend server Obviously the servers who received the extracted HTTP request from the cloudflare web proxies were getting killed but cloudflare didn't even accept it as a valid security problem. AFAIK there was no magic AI security monitoring anomaly detection thing which blocked anything. Sometimes I'd love to see the old web application firewall warnings for single and double quotes just to see if the thing is still there. But maybe it's misconfiguration on side of cloudflare user because I can remember they at least had a WAF product in the past.
    - benregenspan 2y ago
      > But maybe it's misconfiguration on side of cloudflare user because I can remember they at least had a WAF product in the past They still have a WAF product, though I don't think anything in the standard managed ruleset will fire just on quotes, the SQLi and XSS checks are a bit more sophisticated than that. From personal experience, they will fire a lot if someone uses a WAF-protected CMS to write a post about SQL.
- chefandy 2y ago

michaelbuckbee 2y ago

What is the https://chatgpt.com/backend-api/attributions https://chatgpt.com/backend-api/attributions endpoint doing (or responsible for when not crushing websites).

bflesch 2y ago
When ChatGPT cites web sources in it's output to the user, it will call `backend-api/attributions` with the URL and the API will return what the website is about. Basically it does HTTP request to fetch HTML `<title/>` tag. They don't check length of supplied `urls[]` array and also don't check if it contains the same URL over and over again (with minor variations). It's just bad engineering all around.
- JohnMakin 2y ago
  Even if you were unwilling to change this behavior on the application layer or server side, you could add a directive in the proxy to prevent such large payloads from being accepted as an immediate mitigation step, unless they seriously need that parameter to have unlimited number of urls in it (guessing they have it set to some default like 2mb and it will break at some limit, but I am afraid to play with this too much). Somehow I doubt they need that? I don't know though.
  - bflesch 2y ago
    Cloudflare is proxy in front of the API endpoint. After it became apparent that BugCrowd is tarpitting me and OpenAI didn't care to respond, I reported to Cloudflare via their bug bounty because I thought it's such a famous customer they'd forward the information. But yeah, cloudflare did not forward the vulnerability to openai or prevent these large requests at all.
    - JohnMakin 2y ago
      I mean, whatever proxy is directly in front of their backend. I don't pretend to know how it's set up, but something like nginx could nip this in the bud pretty quickly as an emergency mediation, was my point.

hassleblad23 2y ago

I am not surprised that OpenAI is not interested if fixing this.

bflesch 2y ago
Their security.txt email address replies and asks you to go on BugCrowd. BugCrowd staff is unwilling (or too incompetent) to run a bash curl command to reproduce the issue, while also refusing to forward it to OpenAI. The support@openai.com waits an hour before answering with ChatGPT answer. Issues raised on GitHub directly towards their engineers were not answered. Also Microsoft CERT & Azure security team do not reply or care respond to such things (maybe due to lack of demonstrated impact).
- permo-w 2y ago
  why try this hard for a private company that doesn't employ you?
  - inetknght 2y ago
    Some people have passion.
  - myself248 2y ago
    Maybe it's wrecking a site they maintain or care about.
  - deleted 2y ago
    [deleted]
  - bflesch 2y ago
    Ego, curiosity, potential bug bounty & this was a low hanging fruit: I was just watching API request in Devtools while using ChatGPT. It took 10 minutes to spot it, and a week of trying to reach a human being. Iterating on the proof-of-concept code to increase potency is also a nice hobby. These kinds of vulnerabilities give you good idea if there could be more to find, and if their bug bounty program actually is worth interacting with. With this code smell I'm confident there's much more to find, and for a Microsoft company they're apparently not leveraging any of their security experts to monitor their traffic.

soupfordummies 2y ago

Try it and let us know :)

dangoodmanUT 2y ago

has anyone tested this working? I get a 301 in my terminal trying to send a request to my site

bflesch 2y ago
Hopefully they'd have it fixed by now. The magic of HN exposure...

mitjam 2y ago

How can it reach localhost or is this only a placeholder for a real address?

bflesch 2y ago
The code in the github repo has some errors to prevent script kiddies from directly copy/pasting it. Obviously the proof-of-concept shared with OpenAI/BugCrowd didn't have such errors.
- mitjam 2y ago
  Ah ok, thanks, that makes sense. Btw the ChatGPT Web App (haven’t tested with the Desktop App) can find info from local/private sites with the search tool, i assume they browse with a client side function.
  - bflesch 2y ago
    Yeah I first wanted to use this bug to scan their IP ranges and figure out their internal network (e.g. make requests to 10.0.0.1, 10.0.0.2, and so on). But then I realized that it will hallucinate an answer for every IP it is given :) So it would just come up with titles of random router admin panel websites.

andai 2y ago

Is 5000 a lot? I'm out of the loop but I thought c10k was solved decades ago? Or is it about the "burstiness" of it? (That all the requests come in simultaneously -- probably SSL code would be the bottleneck.)

hombre_fatal 2y ago
c10k is about efficiently scheduling socket connections. it doesn’t make sense in this context nor is it the same as 10k rps.
bflesch 2y ago
I'm not a DDOS expert and didn't test out the limits due to potential harm to OpenAI. Based on my experience I recognized it as potential security risk and framed it as DDOS because there's a big amplification factor: 1 API request via Cloudflare -> 5000 incoming requests from OpenAI - their requests come in simultaneously from different ips - each request downloads up to 10mb of random data (tested with multi-gb file) - the requests come from different azure IP ranges, either bc they kept switching them or bc of different geolocations. - if you block them on the firewall their requests still hammer your server (it's not like the first request notices it can't establish connection and then the next request TO SAME IP would stop) I tried to get it recognized and fixed, and now apparently HN did its magic because they've disabled the API :) Previously, their engineers might have argued that this is a feature and not a bug. But now that they have disabled it, it shows that this clearly isn't intended behavior.

smokel 2y ago

Am I correct in understanding that you waited at most one week for a reply? In my experience with large companies, that's rather short. Some nudging may be required every now and then, but expecting a response so fast seems slightly unreasonable to me.

nurettin 2y ago

They don't care. You are just raising their costs which they will in return charge their customers.

anthony42c 2y ago

Where does the 5000 HTTP request limit come from? Is that the limit of the URLs array? I was curious to learn more about the endpoint, but can't find any online API docs. The docs ChatGPT suggests are defined for api.openapi.com, rather than chatgpt.com/backend-api. I wonder if its reasonable (from a functional perspective) for the attributions endpoint not to place a limit on the number of urls used for attribution. I guess potentially ChatGPT could reference hundreds of sites and thousands of web pages in searching for a complex question that covered a range of different interrelated topics? Or do I misunderstand the intended usage of that endpoint?

deleted 2y ago

[deleted]

pabs3 2y ago

Could those 5000 HTTP requests be made to go back to the ChatGPT API?