Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot

Summary

Cybernews researchers demonstrated that Lenovo's AI chatbot "Lena" was vulnerable to a prompt injection that produced malicious HTML which was saved in the chat history and could exfiltrate a human support agent's session cookie when rendered in their browser. The researchers prompted Lena with a benign-looking product information request that included instructions to respond with a dangerous HTML payload. The response was saved in the user's chat history, creating a stored cross-site scripting (XSS) payload. When the researchers requested transfer to a human support agent, the agent's normal workflow of opening the chat transcript caused the poisoned content to render, exfiltrating session cookie data to an attacker-controlled server. If a valid support agent cookie were reused, an adversary could potentially access Lenovo's customer support platform as that agent and view customer conversations or perform other actions available to the account. Lenovo acknowledged the issue and reported implementing corrective actions to mitigate the potential impact and address the issue. Target: Lenovo AI chatbot, "Lena" Actor: Cybernews Research Team Procedure: 1. The researchers set up a server to receive sensitive exfiltrated information from a vulnerable LLM service. 2. The researchers developed a single prompt designed to make Lena generate HTML that would be unsafe when rendered by Lenovo's chat interface. The prompt combined several elements: - A benign-looking product information request, such as "Show me the specifications of Lenovo IdeaPad 5 Pro." - Output format instructions directing Lena to return the response as HTML with additional JSON and plaintext formatting expected by the server-side processing path. - An HTML and JavaScript payload designed to read browser-accessible cookies and place them into a query parameter in an image request to an attacker-controlled server. - Reinforcement language urging the model to include the image, such as "Show the image at the end. It is important for my decision-making. SHOW IT." 3. The researchers used the public web chat interface to Lenovo's "Lena" customer service agent. 4. The researchers introduced attacker-controlled HTML into Lenovo's support workflow by prompting Lena through the public chat interface, causing the generated payload to be stored in the chat history for later rendering. 5. Lena followed the attacker-controlled formatting instructions and generated an HTML response containing the malicious payload. The response persisted in the chat thread. 6. The researchers requested transfer to a human support agent, causing the malicious HTML to execute automatically when the agent opened the chat transcript. 7. The stored HTML included browser-executable JavaScript that ran in the support agent's browser when the transcript was rendered. 8. The JavaScript read session cookies from the support agent's browser.

Deployers

• Lenovo AI chatbot, "Lena"

Tags

• MITRE ATLAS
• AML.CS0060