Summary
The profile update functionality is vulnerable to Cross-Site Request Forgery (CSRF). An authenticated user can be forced to submit a forged request that modifies their account profile information without their knowledge or consent. The endpoint processes state-changing requests without sufficient CSRF protection, such as validating a unique anti-CSRF token or verifying the request origin.
Affected Endpoint
URL: https:
Description
The application allows authenticated users to modify profile information through the account settings page. If the profile update request lacks proper CSRF protection, an attacker can craft a malicious webpage that automatically submits a forged request while the victim is logged into Amplenote.
Because the victim's browser automatically includes session cookies with the request, the server may accept the forged request and update the user's profile information without requiring any additional verification.
Steps to Reproduce
Log in to your Amplenote account.
Navigate to:
https:
Intercept the profile update request using Burp Suite.
Observe that the request can be replayed without a valid CSRF token or proper Origin/Referer validation.
Create a malicious HTML page that submits the same request with attacker-controlled profile values.
While remaining logged into Amplenote, visit the malicious webpage.
The browser automatically submits the forged request.
The profile information is modified without the victim intentionally performing the action.
Proof of Concept
<html>
<body onload="document.forms[0].submit()">
<form action="https://www.amplenote.com/account/profile" method="POST">
<input type="hidden" name="display_name" value="Attacker Modified">
<input type="hidden" name="bio" value="Modified through CSRF">
</form>
</body>
</html>
If the server accepts the request without validating a CSRF token or request origin, the profile information will be updated.
Impact
An attacker may be able to:
Modify the victim's public profile information.
Deface the victim's account profile.
Insert misleading or malicious content into profile fields.
Damage user trust and account integrity.
Combine this issue with other vulnerabilities for more advanced social engineering attacks.
Business Impact
Loss of integrity of user account information.
Reputation damage caused by unauthorized profile modifications.
Increased customer support requests.
Reduced user confidence in the platform's account security.
Remediation
Implement standard CSRF protections for all state-changing endpoints by:
Requiring cryptographically secure anti-CSRF tokens.
Validating the Origin and Referer headers.
Using SameSite=Lax or SameSite=Strict cookies where appropriate.
Requiring re-authentication for sensitive profile changes where appropriate.
Logging and monitoring suspicious profile update attempts.
References
CWE-352: Cross-Site Request Forgery (CSRF)
OWASP Cross-Site Request Forgery Prevention Cheat Sheet