Summary
The email change page accepts Unicode homoglyph characters within the email address field without proper validation or normalization. An attacker can register or change an email address using visually deceptive Unicode characters that closely resemble standard ASCII characters.
Example payload:
𝓹𝓪𝓽𝓻𝓲𝓬𝓴@example.com
Although this address visually appears similar to a legitimate email, it contains Unicode mathematical script characters rather than normal Latin letters. Accepting such addresses can facilitate phishing, user impersonation, identity confusion, and social engineering attacks. Unicode security considerations recommend careful handling of visually confusable characters to prevent spoofing attacks.
Description
The application allows users to submit an email address containing Unicode homoglyph characters during the email update process.
The server accepts the Unicode email without warning, normalization, or validation against visually confusable characters.
An attacker can create an email that appears identical to another user's legitimate address, making it difficult for users, administrators, or support staff to distinguish between the two.
Example:
Legitimate:
patrick@example.com
Malicious:
𝓹𝓪𝓽𝓻𝓲𝓬𝓴@example.com
To most users these addresses appear nearly identical, despite being technically different.
Steps to Reproduce
Login to an Amplenote account.
Navigate to:
https:
Enter the following payload:
𝓹𝓪𝓽𝓻𝓲𝓬𝓴@example.com
Submit the email change request.
Observe that the application accepts or processes the Unicode email without rejecting it or displaying a security warning.
Proof of Concept
Payload used:
𝓹𝓪𝓽𝓻𝓲𝓬𝓴@example.com
Expected Result:
Reject Unicode confusable characters.
Allow only normalized ASCII email addresses (or warn users if internationalised email addresses are intentionally supported).
Actual Result:
The application accepts visually deceptive Unicode characters inside the email field.
Security Impact
If exploited, an attacker could:
Register deceptive email identities that visually mimic legitimate users.
Impersonate trusted users during communication.
Increase the success rate of phishing and social engineering attacks.
Confuse administrators during account verification or support interactions.
Create audit log ambiguity where different accounts appear visually identical.
Damage user trust and the platform's reputation if spoofed identities are used maliciously.
Business Impact
Increased phishing risk.
User account confusion.
Potential account recovery mistakes.
Higher support workload due to identity ambiguity.
Loss of customer trust.
Reputational damage to the platform.
Recommended Remediation
Normalize email input before validation.
Detect and reject visually confusable Unicode characters in email local parts where appropriate.
Enforce a strict ASCII-only policy unless internationalised email (EAI) support is intentionally required.
Implement Unicode confusable detection based on Unicode security guidance.
Clearly warn users when non-ASCII characters are entered in email fields.
References
Unicode Security Considerations (UTR #36).