ChatGPT API vulnerability enables potential DDoS attacks
Security researcher Benjamin Flesch reportedly discovered a vulnerability in ChatGPT's API that could allow attackers to conduct distributed denial-of-service attacks by submitting unlimited duplicate URLs without triggering safeguards. The flaw lacks rate-limiting and duplicate filtering mechanisms that would normally prevent such abuse.
What happened
A security researcher Benjamin Flesch discovered a vulnerability in OpenAI's ChatGPT API that could enable distributed denial-of-service attacks.
The flaw lies in the API's /backend-api/attributions endpoint, which accepts an unlimited number of URLs in a single request without verifying duplicates or enforcing limits.
By including thousands of hyperlinks, an attacker could cause OpenAI servers to generate a massive volume of HTTP requests to any target website.
Reported impact
The vulnerability could allow threat actors to use ChatGPT to conduct DDoS attacks on websites, overwhelming target infrastructure.
The absence of rate-limiting or duplicate request filtering mechanisms provides what researchers describe as an amplification vector for malicious purposes.
Index analysis
The vulnerability reflects poor programming practices and insufficient attention to security considerations in the API design.
Security experts recommend OpenAI implement strict limits on URLs submitted, filter duplicate requests, and add rate-limiting measures.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.