Stored HTML Injection in Public Profile Testimonial Field

linkResolution: ❌

Not a bug

img and various HTML formatting & media tags are intentionally allow-listed


linkReport

Summary
A Stored HTML Injection vulnerability exists in the Testimonial field of public user profiles.
 
Affected Endpoint:
https://www.amplenote.com/user_profiles/<slug>
 
The application does not properly sanitize HTML entered into the Testimonial field. An attacker can store HTML that is rendered whenever another user visits the public profile.
 
Steps to Reproduce
Log in to an Amplenote account.
 
Edit your public profile.
 
In the Testimonial field, enter the following payload:
 
"><img src=x><h1>test</h1>
Save the profile.
 
Open or share the public profile:
 
https://www.amplenote.com/user_profiles/<slug>
Observe that the injected HTML is rendered. The <img> and <h1> tags are interpreted by the browser, demonstrating stored HTML injection.
 
Impact
Although JavaScript execution is not possible, rendering attacker-controlled HTML on a public profile can still be abused to manipulate visitors.
 
An attacker could:
 
Display fake banners or notices that appear to be legitimate.
 
Use <img> elements to embed phishing-style graphics, fake login prompts, or security warnings.
 
Insert large headings (<h1>) or other formatting to hide or overshadow legitimate profile content.
 
Mislead visitors into trusting fraudulent messages or following attacker-controlled instructions.
 
Damage the credibility of user profiles and facilitate social engineering attacks.
 
Since the payload is stored, every visitor to the affected profile is exposed until the malicious content is removed.
 
Security Impact
Stored HTML Injection
 
Content spoofing
 
UI manipulation
 
Increased phishing and social engineering risk
 
Remediation
Sanitize all user-supplied HTML before rendering it.
 
Allow only a strict whitelist of safe formatting tags if HTML is required.
 
Escape HTML entities for all unsupported tags and attributes before displaying user content.