通过 HEIF RCE 与权限过大的 SSO token 链进入 OpenAI 内部仓库

1. Basic Information Original Title: Hacking OpenAI Source: Hacktron AI Published Date: 2026-09-13 Updated Date: None Severity: Critical Severity Basis: Researchers achieved RCE on OpenAI Forums via a heap overflow in the HEIF image decoder, chained an over-privileged SSO token, and created a pull request in the internal repository via the employee's ChatGPT/Codex account and connected GitHub. Original Source: Hacking OpenAI Related Sources: SecurityWeek Coverage, Discourse GHSA-vhm9-85gw-x335 Related Entities: CVE-2026-32882, GHSA-vhm9-85gw-x335, libheif, ImageMagick, Discourse, OpenAI SSO, ChatGPT, Codex, GitHub 2. Executive Summary This vulnerability chain begins with RCE in Discourse’s image-processing environment through a crafted HEIF image. The researchers then used an overprivileged forum SSO token to access an employee’s ChatGPT/Codex account and reached an internal repository through Codex’s GitHub connection. 3. Attack Flow From Image Upload to Connected GitHub An attacker uploads a crafted HEIF image to Discourse. Since FastImage does not support it, it passes through ImageMagick to the vulnerable libheif 1.19.7, leading to RCE via a heap overflow. The attacker acquires an over-privileged OpenAI SSO token in the compromised forum environment and accesses the forum user's ChatGPT/Codex account. Via the employee account with GitHub connected, the attacker has Codex create a harmless README change pull request in the internal repository to demonstrate the impact. Researchers used Claude Opus 4.8 and Claude Opus 5 to develop an exploit for an ASLR-enabled environment, but expert guidance was required; the process was not described as fully autonomous. 4. Attacker Position and Execution Location The starting point is a remote user who can upload images. According to the Discourse advisory, low privileges are required. RCE occurred in the image-processing environment, while subsequent access took place through OpenAI SSO, ChatGPT/Codex, and the GitHub integration. 5. Visibility for Victims and Administrators Victim: Simply signing in to the forum could make the account a target. There are no clear signs of manipulation. Administrator: ImageMagick crashes during HEIF conversion, libheif-related exceptions, abnormal SSO tokens, and unexpected GitHub operations from Codex serve as traces. 6. Success and Failure Conditions Success Conditions The Discourse environment containing vulnerable libheif can process HEIF/HEIC. The compromised service uses OpenAI SSO, and its token has excessive permissions for the ChatGPT/Codex API. The target account has external services such as GitHub connected. Failure Conditions Rebuild the Discourse Docker image and apply the patched libheif and image processing sandbox. Limit SSO tokens to minimal scopes per use case and revoke existing tokens and sessions. 7. What Happens Upon Success RCE in the forum environment, takeover of the ChatGPT/Codex account, and operation of connected services become possible. In the demonstration, metadata and commits of the internal GitHub repository were read in a limited manner, and a pull request was created for the README. Actual access to Slack messages was not confirmed. 8. Observable Logs Email: Check for account notifications or token revocation notifications. Proxy / SWG / DNS: Check for image uploads, abnormal communication from the image processing environment, and communication to connected service APIs. Endpoint / EDR: Check for ImageMagick process crashes, libheif-related exceptions, abnormal memory access, and shells inside the image processing container. Identity / IdP: Check for ChatGPT/Codex API access using forum-use tokens and session reuse. SaaS / Cloud: Check Codex operation history, GitHub pull request and metadata reading, and use of connection settings. Network: Check for abnormal communication from the image processing layer to the IdP, API, and GitHub. 9. Attack Success Determination Confirmed in Public Information Subsequent Compromise Confirmed: Researchers used an OpenAI employee account to create a README change pull request in an internal GitHub repository. OpenAI confirmed limited access to repository metadata and commits, along with pull request creation, and stated that Slack messages were not accessed. Criteria for Own Organization Initial Execution Confirmed: Correlate crafted image processing with code execution in the image conversion environment. Data Theft or Session Compromise Confirmed: Confirm SSO token acquisition and reuse, and access to other service APIs. Subsequent Compromise Confirmed: Confirm actual reads and changes in connection destinations such as GitHub using audit logs. 10. Investigation Playbook Trigger: Start with HEIF conversion crashes, unpatched Discourse, abnormal SSO scopes, and Codex-derived pull requests. Initial Check: Check libheif and Discourse versions, Docker rebuild dates, image uploads, and SSO settings. Endpoint: Preserve image processing containers, crashes, shells, and file modifications. Authentication / Cloud: Revoke and reissue SSO tokens, all sessions, and connected service permissions. Subsequent Operations: Check audit logs for GitHub, Slack, email, etc., per connection unit. Containment: Stop and isolate image processing, rebuild Docker, minimize and revoke tokens. Determination Categories: Separate image reception, RCE, SSO compromise, and destination access. 11. Defense and Detection Ideas Single Event: Detect image conversion process crashes, child shells, and mass HEIF submissions. Time-Series Correlation: Correlate image uploads, conversion anomalies, SSO usage, Codex operations, and GitHub changes. Hunting: Inventory vulnerable libheif, old Discourse Docker, overly broad SSO scopes, and connected high-privilege services. Log Deficiency: Without identifiers spanning SSO issuance, API usage, and connector operations, the chain cannot be tracked. Priority Countermeasures: Prioritize decoder updates, image processing sandboxing, token least privilege, and re-authentication of connection destinations. 12. Facts / Inference / Hypothesis Facts The Discourse advisory rated image upload RCE via CVE-2026-32882 as CVSS 8.8 and guided users to patched versions and Docker rebuilds. OpenAI reduced SSO token permissions and revoked affected tokens and sessions. Researchers demonstrated the chain in less than 72 hours and received a $6,500 bounty for the issue on OpenAI's side. Inference Even low-trust community services can become a path to critical assets if common SSO and high-privilege connectors are present, so trust boundaries must be separated on a per-service basis. Hypothesis No additional hypotheses. Unverified items are listed in "Unknowns and Additional Investigation." 13. MITRE ATT&CK Mapping T1190 Exploit Public-Facing Application (Confidence: high): Exploits image processing vulnerabilities in public forums. T1528 Steal Application Access Token (Confidence: high): Obtains OpenAI SSO application access tokens from the compromised forum environment. T1550.001 Use Alternate Authentication Material: Application Access Token (Confidence: high): Uses the obtained overprivileged token to access ChatGPT/Codex APIs. 14. Unknowns and Additional Investigation Specific token scopes of the OpenAI SSO issue and all affected services. Presence of exploitation by parties other than the researchers. Range of other libheif-using services where the same chain is established. 15. Impact on SOCs and Organizations When low-level dependencies like image decoders are chained with SSO, AI agents, and GitHub connectors, a seemingly low-importance forum becomes a pathway to development assets. It is necessary to simultaneously proceed with dependency updates, token usage restrictions, and the minimization of external services that agents can operate. 16. Summary by Target Audience SOC: Correlate logs from image processing, SSO, Codex, and GitHub by the same user and time. Administrator: Rebuild Discourse, update libheif, isolate image processing, minimize SSO scope, and revoke sessions. User: Report suspicious account operations or connection changes, and regularly review linked services.