Summary
The public profile messaging feature allows users to send messages containing arbitrary URLs, which are automatically converted into clickable hyperlinks in email notifications.
An attacker can abuse this behavior to send malicious links via trusted Amplenote emails, enabling phishing attacks.
Vulnerability Type
Hyperlink Injection (Auto-linking Abuse)
Lack of URL Validation
Affected Feature
Public Profile Messaging
Email Notification System
Example:
https:
Steps to Reproduce
Open a public profile:
https:
Click “Send Message”
Enter a message containing a malicious URL:
Please check this: https:
Send the message
Observe:
The recipient receives an email
The URL is automatically converted into a clickable hyperlink
Impact
Security Impact
Enables phishing attacks via trusted domain emails
Victims are more likely to click links from legitimate platform notifications
Can lead to:
Credential harvesting
Account takeover
Malware delivery
Abuse Scenario
Combined with your email alias bypass finding, an attacker can:
Create multiple accounts
Send bulk messages
Deliver phishing links at scale from Amplenote emails
👉 This significantly increases severity.
Proof of Concept Payloads
https:
https:
https:
Root Cause
System automatically converts URLs into clickable links
No validation, filtering, or warning for external domains
No anti-abuse controls on messaging
Recommendation
1. Add URL Validation
Detect and flag suspicious domains
Consider domain reputation checks
2. Add User Warning
Show warning for external links:
“This link leads to an external site”
3. Limit Abuse
Rate limit messaging
Detect bulk messaging patterns
4. Email Hardening
Disable automatic hyperlinking OR
Add safe-link wrapping / scanning
Final Note
While auto-linking URLs is common, the lack of abuse prevention + trust context (email delivery) makes this exploitable for phishing at scale.