Summary
The email change functionality is vulnerable to Cross-Site Request Forgery (CSRF). The endpoint responsible for updating the account email address accepts authenticated requests without validating a unique CSRF token or verifying the request origin. As a result, an attacker can craft a malicious webpage that silently submits a forged request from a victim's browser while they are logged into Amplenote.
If a logged-in user visits the attacker's website, their account email address can be changed without their knowledge or consent.
Affected Endpoint
https:
Description
The application fails to properly protect the sensitive email change functionality against CSRF attacks.
Since browsers automatically include the victim's authenticated session cookies with cross-site requests (unless additional protections prevent this), an attacker can exploit this behaviour by hosting a malicious HTML page that automatically submits a forged request to the vulnerable endpoint.
Changing the registered email address is a highly sensitive account operation. Without CSRF protection, an attacker may replace the victim's email with one under their control, potentially allowing further account recovery abuse or account takeover depending on the application's authentication flow.
Steps to Reproduce
Log in to your Amplenote account.
Navigate to the email change page:
https:
Intercept the request using Burp Suite.
Observe that the request can be replayed without a valid anti-CSRF token or Origin/Referer validation.
Create a malicious HTML page that automatically submits the same request containing an attacker-controlled email address.
Keep the victim logged into Amplenote.
Convince the victim to visit the malicious webpage.
The forged request is automatically submitted using the victim's authenticated session.
The victim's email address is updated without intentionally performing the action.
Proof of Concept
<html>
<body onload="document.forms[0].submit()">
<form action="https://www.amplenote.com/account/email" method="POST">
<input type="hidden" name="email" value="attacker@example.com">
</form>
</body>
</html>
If the endpoint accepts the request without validating a CSRF token or verifying the request origin, the email change will be processed.
Security Impact
Successful exploitation may allow an attacker to:
Change the victim's registered email address.
Interfere with account recovery.
Receive future account notifications.
Potentially gain full account takeover if password reset emails are delivered to the newly registered email.
Lock legitimate users out of their accounts.
Compromise sensitive notes and personal information stored in the account.
Business Impact
User account compromise.
Loss of customer trust.
Exposure of sensitive user data.
Increased support requests for account recovery.
Potential compliance and privacy risks.
Remediation
Implement robust CSRF protections for all state-changing requests by:
Requiring cryptographically secure anti-CSRF tokens.
Validating the Origin and Referer headers.
Using SameSite=Lax or SameSite=Strict cookies where appropriate.
Requiring password re-authentication before changing the account email.
Sending a confirmation link to the new email address before the change becomes effective.
Notifying the existing email address whenever an email change request is initiated.
References
CWE-352: Cross-Site Request Forgery (CSRF)
OWASP Cross-Site Request Forgery Prevention Cheat Sheet