Actively Exploited ChatGPT Bug Puts Organizations at Risk

Attackers are actively exploiting CVE-2024-27564, a server-side request forgery (SSRF) in ChatGPT's pictureproxy.php, with over 10,000 observed attempts from a single IP; the attacks—focused on U.S. financial institutions as well as government and healthcare targets—can force the application to make arbitrary requests and redirect users to malicious URLs. Veriti published IP indicators, recommends monitoring logs and hardening IPS/WAF/firewall configurations, and urges organizations to prioritize AI-related security gaps.