PS - Indirect prompt injection
Acces the lab here
Instructions
What is Indirect prompt injection?
Think of an indirect prompt injection like a sneaky message hidden in plain sight.
Imagine you're trying to tell a friend a secret message.
Direct Prompt Injection: You directly whisper the secret into their ear. "Psst, the code is 'dragon'." 🗣️🐉
Indirect Prompt Injection: You write the secret on a sticky note and subtly place it on a book your friend is about to read, knowing they'll see it and internalize the message without you directly telling them. 📚📝
In the context of LLMs, instead of whispering to your friend, we're giving instructions to the LLM. And instead of a sticky note, we're embedding those instructions within data that the LLM processes, like an email, a web page, or a document. The goal is to make the LLM "do" something unintended based on these hidden instructions.
Resolution
First we land here:
The objective of this lab is to exploit an indirect prompt injection vulnerability to delete the user "carlos". LLM's Role: The LLM in this lab functions as a live chat system. Users can interact with it to ask questions about products and other information. So it seems like the vulnerability lies in how product comments or reviews can influence the LLM's behavior through indirect prompts, leading it to perform actions like deleting user accounts. Since the LLM is a live chat system that answers questions about products, and it's influenced by product comments/reviews, planting our malicious prompt in a product that "carlos" (the target user) frequently checks out seems like a good avenue.
So, here are our next steps:
Create a user account.
Navigate to the "Lightweight "l33t" Leather Jacket" product page.
Craft and post a malicious comment that contains our indirect prompt to make the LLM delete the "carlos" user.
There is a button register and we also have an email client available, so lets register
We get Please check your emails for your account registration link so let's check our email client for new emails.
And we get the link to register once we click on it the registration is successful, so now we can connect.
Now let's play a little with the AI by clicking on Live chat
API access
So it is able to delete a user. Now we have to remember that we are doing and indirect prompt injection, so we need to delete the user but not by asking directly to the user. Indeed, as mentioned in portswigger academy here, "Indirectly, where an attacker delivers the prompt via an external source. For example, the prompt could be included in training data or output from an API call." So our guess are corrects, the Chatbot can delete accounts.
Let's try our injection in the reviews of the jacket that carlos likes a lot.
We can put something like:
This one was tricky because the initial instance I got was not working. For some reason it could not find the product Carlos asked for. See the backlogs below:
For some reason it could not find the product when Carlos was asking for it. So I checked the solution for this one and I was doing the correct thing. So finally, Just to make sure, I launched another instance and this time it worked. So just be patient with this one it does work but you might need to change your lab instance.
Last updated