As the developers have failed to respond within the 90-day deadline from time of disclosure, the tool should be disabled immediately
Users of the generative AI tool named “EmailGPT” should know by now that a prompt injection vulnerability (CVE-2024-5184s) has been found in the code.
The vulnerability allows attackers to overwrite instructions, change the behavior or the AI, and exfiltrate data from the system, in ways that are somewhat similar to what happened with GitHub Copilot leaking intellectual property.
According to the software’s website, the generative AI (GenAI) tool and Google Chrome extension “uses advanced machine learning algorithms to analyze your past emails and attachments to understand your business and relationships. It then summarizes all incoming emails and even drafts replies for you to review and send.”
The service uses an application programming interface (API) service that, when compromised, can allow a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts.
Exploiting the vulnerability
According to the researchers from the Synopsys Cybersecurity Research Center who exposed the vulnerability, anyone with access to the EmailGPT service can exploit the vulnerability by submitting a malicious prompt that requests harmful information. The system will respond by providing the requested data.
This could lead to intellectual property leakage, denial-of-service, and direct financial loss through an attacker making repeated requests to the AI provider’s API which are pay-per-use.
The vulnerability has been evaluated to score 6.5 on the Common Vulnerability Scoring System.
Synopsys has already reached out to the developers, but as of the time of this story (from 26 Feb to June 2024), the firm has not received a response within the 90-day timeline dictated by responsible disclosure policy.
Therefore, it is recommended that users of the browser extension remove it from their networks immediately.
