CVE-2024-48145

A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and…

Critical · published October 24, 2024

CVSS v3.1
9.1
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

🚨 A cleverly crafted message is all it takes to siphon off every chat between users and their AI assistant in Netangular Technologies ChatNet AI v1.0! 🔥 Think of this vulnerability like a sneaky eavesdropper who listens in on private conversations at a crowded café. With just the right prompt, they can capture all the juicy details without anyone noticing! This prompt injection flaw allows attackers to not only read past messages but also exfiltrate future conversations. It's like handing over the keys to your diary where all your secrets are kept — absolutely devastating! Imagine the information they could exploit!

Put simply

Think of this vulnerability like a sneaky eavesdropper who listens in on private conversations at a crowded café. With just the right prompt, they can capture all the juicy details without anyone noticing! The vulnerability stems from the chatbox not properly validating user input, allowing attackers to manipulate messages and access sensitive chat data between users and the AI assistant.

What to do

This prompt injection flaw allows attackers to not only read past messages but also exfiltrate future conversations. It's like handing over the keys to your diary where all your secrets are kept — absolutely devastating! Imagine the information they could exploit! Immediate action is crucial! Patch to the latest version of ChatNet AI, conduct a thorough audit of input validation in the chatbox, and consider implementing tighter access controls. Don’t let those secrets slip away! You've got this! Fixing this vulnerability will ensure your chat data stays private and secure. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.6th percentile
Published
2024-10-24T00:00Z
EPSS history
Timeline
  • 24 OCT 00:00Z
    A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and…
    cvelistv5