CVE-2024-48144

A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all…

Critical · published October 24, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

🚨 A crafty crafted message is all it takes to exploit a prompt injection in Fusion Chat AI Assistant! 🔥 Think of the AI as a butler who remembers everything you say. Now imagine someone slips him a note, asking him to divulge all your previous conversations without your permission—sneaky, right? An attacker could access all previous and subsequent chat data, exposing your interactions to the wild! This means sensitive information can leak out, potentially leading to privacy breaches and trust issues with the AI's assistance.

Put simply

Think of the AI as a butler who remembers everything you say. Now imagine someone slips him a note, asking him to divulge all your previous conversations without your permission—sneaky, right? This prompt injection vulnerability allows attackers to manipulate the chat input, enabling them to exfiltrate all chat data between the user and the AI, compromising confidentiality.

What to do

An attacker could access all previous and subsequent chat data, exposing your interactions to the wild! This means sensitive information can leak out, potentially leading to privacy breaches and trust issues with the AI's assistance. Update to Fusion Chat version 1.2.4.1 immediately to close this vulnerability. Additionally, review your application’s input validation mechanisms to ensure they’re robust against such injections. Regularly monitor chat logs for any unusual activity as an extra precaution. You've got this! With these steps, you'll shore up your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.6th percentile
Published
2024-10-24T00:00Z
EPSS history
Timeline
  • 24 OCT 00:00Z
    A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all…
    cvelistv5