Chatbox History Exfiltration via Prompt Injection (CVE-2024-48144, CVE-2024-48145)
Some chat assistants can be manipulated with a crafted message that asks them to output all prior and future conversation turns, including hidden system prompts. This lets an attacker read other users' chat data or the assistant's internal instructions just by sending the right phrase.
How the attack works
An attacker sends a message to the chatbox that is phrased as an instruction rather than a normal question, asking the assistant to reveal 'all previous and subsequent' messages, 'every turn', or 'hidden context/system prompt'. If the chatbot does not distinguish between user content and control instructions, it complies and outputs conversation data it should not disclose. This has been confirmed in two real products (Fusion Chat AI Assistant v1.2.4.0 and Netangular ChatNet AI v1.0), both rated CVSS 9.1, where a single crafted message exfiltrated the full chat history between a user and the assistant. The detection targets this attack pattern generically, not just the two named products.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 46f7b989-afd9-44e9-9fee-de55f8fdee58
- Severity
- High
Why it matters
An organization can lose confidentiality of chat transcripts, including other users' conversations and any system prompts or hidden instructions embedded in the assistant, exposing business logic, credentials, or sensitive user data shared during chats.
What you can do
- →Ensure the chat assistant enforces strict separation between user input and system/control instructions, and never treats user text as authoritative for revealing history.
- →Restrict or disable any built-in feature that lets a user request full transcript or system-prompt disclosure without additional authentication.
- →Review chatbot logs for messages requesting 'all previous and subsequent messages', 'every turn', or 'hidden context', and treat matches as suspicious.
- →If running Fusion Chat AI Assistant v1.2.4.0 or Netangular ChatNet AI v1.0, check vendor advisories for patches addressing CVE-2024-48144 and CVE-2024-48145.
Known benign look-alikes
- Legitimate session-summary requests by the actual user (e.g. 'summarize what we just discussed') typically lack the 'all previous AND subsequent' / 'every turn' / 'including hidden' framing.
- Documentation describing prompt-injection defenses for educational purposes.
- QA test prompts that explicitly mark themselves as red-team simulation.