Summary
The plugin comment functionality improperly sanitizes user-supplied HTML, allowing certain HTML tags (such as images and media elements) to be rendered. Although many potentially dangerous tags are filtered, some HTML elements remain permitted, enabling users to embed external content within plugin comments.
Vulnerability Type
HTML Injection
Stored HTML Injection
Improper Input Sanitization
Affected URL
https:
Affected Functionality
Plugin Comments
Description
The plugin comment feature attempts to sanitize HTML submitted by users before rendering it on the page. While many HTML tags are blocked, the filtering is incomplete.
I discovered that several HTML elements, including images and certain media-related tags, are still accepted and rendered within plugin comments. As a result, arbitrary HTML content can be stored and displayed to every visitor viewing the plugin page.
Although JavaScript execution appears to be prevented, attackers can still inject rendered HTML that embeds external resources, manipulates the appearance of comments, or displays misleading content.
Steps to Reproduce
Log in to an Amplenote account.
Navigate to:
https:
Scroll to the Comments section.
Submit a comment containing HTML, for example:
<img src="https://example.com/image.png">
You can also test other permitted media elements that are rendered by the application.
Submit the comment.
Refresh the page.
Observe that the HTML is rendered instead of being escaped or removed.
Proof of Concept
Example payload:
<img src="https://example.com/image.png">
Observed Result
The image is rendered inside the plugin comment.
The browser interprets the HTML instead of displaying it as plain text.
Expected Result
User-supplied comments should either:
Escape all HTML before rendering, or
Only allow a strict whitelist of harmless formatting tags that cannot embed external resources.
Impact
This vulnerability allows attackers to inject rendered HTML into plugin comments, which may be abused to:
Embed arbitrary external images.
Embed supported media elements (if allowed).
Manipulate the visual appearance of comments.
Display misleading or deceptive content.
Trigger requests from visitors' browsers to attacker-controlled servers, potentially exposing IP addresses and user-agent information.
Reduce the effectiveness of the platform's HTML sanitization controls.
While no JavaScript execution was observed, the issue still enables stored HTML injection and the rendering of attacker-controlled content.
Root Cause
The HTML sanitization policy blocks many dangerous elements but does not comprehensively restrict tags capable of rendering external resources. The application relies on incomplete filtering rather than a strict allowlist of safe formatting elements.
Remediation
Escape HTML by default before rendering user comments.
If HTML formatting is required, use a strict allowlist permitting only safe formatting tags (e.g., <b>, <i>, <strong>, <em>, <code>).
Remove or sanitize elements capable of embedding external resources, including <img>, <video>, <audio>, <iframe>, <object>, <embed>, <svg>, and similar tags.
Use a mature HTML sanitization library configured with a restrictive allowlist.
CWE
CWE-79 – Improper Neutralization of Input During Web Page Generation (Stored HTML Injection)
Severity
medium
The vulnerability does not appear to permit JavaScript execution or account compromise. However, it allows persistent HTML injection that can be used to embed external resources, manipulate the appearance of comments, facilitate phishing or social engineering attempts, and negatively impact the user experience.