PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Getting XXE in Web Browsers using ChatGPT

swarm.ptsecurity.com | research | #browser-security | #xxe | #chatgpt | #same-origin-policy | #xslt | #svg
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Can a JavaScript-less page read local files? ChatGPT-generated samples expose browser XSL/XML vectors — XSLT, XInclude and document() — that reach file:// content despite the SOP.
Published
Collected

Related coverage

blog · hacktron.ai
Pwning OpenAI Atlas Through Exposed Browser Internals
A critical ChatGPT Atlas Browser vulnerability: XSS on an OpenAI subdomain let attackers hijack tabs, leak browsing URLs, and steal OAuth tokens.
research · swarm.ptsecurity.com
Impossible XXE in PHP
PT SWARM shows an 'almost impossible' XXE in PHP is exploitable by defeating four defenses — disabled entity loading, LIBXML_NONET, missing NOENT, a DOM nodeType check — using parameter entities.
research · swarm.ptsecurity.com
Bypassing browser tracking protection for CORS misconfiguration abuse
PT SWARM shows CORS misconfigurations — reflected Origin plus credentials — can still leak sensitive data despite tracking protection, by bypassing the block on third-party requests.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Using Hackability to uncover a Chrome infoleak
Using his Hackability Inspector, Gareth Heyes found a Chrome infoleak: setting a cross-domain iframe to about:blank exposed baseURI, leaking full URLs and enabling OAuth token theft across subdomains.
Back