Summary

Since last year, the race to develop AI products has led to an explosion in the number of products out in the market. Speed and security have an inverse relation, in a general sense. Therefore, security has seen a great hit and now and then, we notice an AI application having numerous seemingly simple security issues. The same was the case with NextChat, a.k.a ChatGPT-Next-Web, which before version 2.11.3 was vulnerable to an SSRF and a reflected XSS vulnerability. This post aims to help you set up a vulnerable testbed for the same application and perform guided target exploration and exploitation along with the root cause analysis of the vulnerability. The post requires no knowledge of AI and thus can be followed without any fears. All you need is an open mind, some common sense, and a virtual machine (Linux preferably) to hack around with the AI chatbot!

Description