How OpenAI got hacked with an image | LiveOverflow

The Gist

Security researchers exploited a one-year-old patched vulnerability in libheif through ImageMagick and Discourse to achieve remote code execution on OpenAI developer forums and gain unauthorized access to internal repositories.

Quick Overview

Security researchers Harsh Jaiswal and Rahul Mohan compromised OpenAI internal infrastructure by chaining a series of vulnerabilities involving image processing libraries and forum software. By uploading a crafted HEIF image to the Discourse community platform, they triggered a heap buffer overflow in libheif that had been patched a year earlier but remained unpatched in the specific Debian Docker container used by Discourse. This exploit successfully executed remote code on community.openai.com, allowing the researchers to escalate their access and create pull requests inside OpenAI internal GitHub repositories.

Key Points: Security researchers Harsh Jaiswal and Rahul Mohan discovered a chain of vulnerabilities allowing remote code execution on the OpenAI developer forum. The attack began by targeting libheif, a library used for handling High Efficiency Image File Format images. A commit made on May 5, 2025, titled simplify overlay overlap area computation, fixed a heap buffer overflow vulnerability in libheif. The vulnerable version of libheif, version 1.19.7, was bundled in the Debian 12 bookworm Docker image used by Discourse instances at the time. When a user uploaded a crafted HEIF image to the Discourse forum, ImageMagick passed the file directly to libheif for conversion, triggering a heap buffer overflow. The exploit successfully achieved remote code execution under the www-data user ID inside the Discourse container environment. By leveraging this forum access, the researchers successfully opened a pull request inside OpenAI internal GitHub repositories to demonstrate the severity of the flaw. OpenAI awarded the researchers $6,500 through their bug bounty program for the vulnerability chain.

Context: OpenAI uses various third-party and open-source applications to run developer communities and internal tools. Security researchers frequently test these platforms for zero-day and n-day vulnerabilities to evaluate the security postures of major artificial intelligence companies.