Summary
A Stored HTML Injection vulnerability exists in the Testimonial field of public user profiles.
Affected Endpoint:
https:
The application does not properly sanitize HTML entered into the Testimonial field. An attacker can store HTML that is rendered whenever another user visits the public profile.
Steps to Reproduce
Log in to an Amplenote account.
Edit your public profile.
In the Testimonial field, enter the following payload:
"><img src=x><h1>test</h1>
Save the profile.
Open or share the public profile:
https:
Observe that the injected HTML is rendered. The <img> and <h1> tags are interpreted by the browser, demonstrating stored HTML injection.
Impact
Although JavaScript execution is not possible, rendering attacker-controlled HTML on a public profile can still be abused to manipulate visitors.
An attacker could:
Display fake banners or notices that appear to be legitimate.
Use <img> elements to embed phishing-style graphics, fake login prompts, or security warnings.
Insert large headings (<h1>) or other formatting to hide or overshadow legitimate profile content.
Mislead visitors into trusting fraudulent messages or following attacker-controlled instructions.
Damage the credibility of user profiles and facilitate social engineering attacks.
Since the payload is stored, every visitor to the affected profile is exposed until the malicious content is removed.
Security Impact
Stored HTML Injection
Content spoofing
UI manipulation
Increased phishing and social engineering risk
Remediation
Sanitize all user-supplied HTML before rendering it.
Allow only a strict whitelist of safe formatting tags if HTML is required.
Escape HTML entities for all unsupported tags and attributes before displaying user content.