Summary
A user can upload a PDF containing embedded JavaScript to a note. When the PDF is opened through Amplenote, it is rendered from the primary application domain (www.amplenote.com), and the embedded JavaScript executes, resulting in a JavaScript popup. This behavior indicates that active content within uploaded PDFs is not sufficiently isolated and may lead to Stored Cross-Site Scripting (XSS) depending on the browser and rendering context.
Vulnerability Type
Potential Stored Cross-Site Scripting (Stored XSS)
Improper File Handling
User-Controlled Active Content Executed from Primary Origin
Affected Note
https:
Description
The application allows users to upload PDF files as note attachments.
During testing, I uploaded a PDF containing embedded JavaScript. The file was accepted and stored successfully. When the attachment is opened through the Amplenote interface, it is rendered from the main www.amplenote.com domain instead of being isolated on a separate file domain or being forced to download.
Opening the PDF causes the embedded JavaScript to execute and display a popup, demonstrating that active content within the uploaded PDF is executed.
If this execution occurs within the application's origin rather than a sandboxed PDF context, it could allow Stored Cross-Site Scripting. Even if browser sandboxing limits the impact, serving user-controlled active content from the primary application domain unnecessarily increases the attack surface.
Steps to Reproduce
Create a PDF containing embedded JavaScript.
Upload the PDF as an attachment to a note.
Open the uploaded PDF from the following note:
https:
Observe that the PDF is rendered from the main application domain.
Observe that the embedded JavaScript executes and displays a popup.
Proof of Concept
Attachment
OrwaGodfather-1.pdf (attached with this report).
The attached PDF contains embedded JavaScript and reproduces the issue when viewed through the affected functionality.
Observed Result
The PDF uploads successfully.
The PDF is rendered on the main Amplenote domain.
Embedded JavaScript executes when the PDF is opened.
A JavaScript popup is displayed.
Expected Result
Uploaded PDFs should be treated as untrusted content by:
Serving them from a dedicated, isolated file domain.
Disabling or stripping active PDF content.
Forcing download where appropriate instead of inline rendering.
Preventing execution of embedded JavaScript.
Impact
If JavaScript executes within the application's origin, an attacker could potentially:
Execute Stored Cross-Site Scripting (XSS).
Perform authenticated requests on behalf of users.
Manipulate application content.
Conduct phishing or UI redressing attacks.
Access origin-scoped resources, depending on browser behavior.
Even if browser sandboxing limits JavaScript execution, serving active user-controlled files from the primary application domain increases the risk and violates origin isolation best practices.
Remediation
Serve uploaded files from a dedicated untrusted file domain (e.g., files.amplenote.com or a separate CDN domain without application cookies).
Force PDFs to download instead of rendering inline where feasible.
Disable or sanitize embedded JavaScript and other active PDF content before serving files.
Apply appropriate Content-Security-Policy, Content-Disposition, and other security headers to uploaded content.
CWE
CWE-79 – Improper Neutralization of Input During Web Page Generation (if confirmed as Stored XSS)
CWE-434 – Unrestricted Upload of File with Dangerous Type
Severity
high
Recommendation: Before submitting, verify whether alert(document.domain) displays www.amplenote.com (or another Amplenote origin). If it does, this substantially strengthens the case that the issue is a true Stored XSS rather than PDF viewer behavior.