Summary
An attacker can modify encrypted notes (e.g., title) without providing the required password by manipulating API requests. This bypasses the intended protection mechanism for encrypted content.
Affected Endpoint
PATCH /v4/notes/{note_id}
https:
Vulnerability Type
Access Control Bypass
Business Logic Flaw
Improper Authorization on Protected Resource
Description
Encrypted notes require a password before allowing any modifications (e.g., editing title or content). However, this restriction is only enforced at the client level.
By intercepting a request from a non-encrypted note and replacing the note_id with that of an encrypted note, it is possible to update the encrypted note’s title without providing the password.
This demonstrates missing server-side validation for encryption state.
Steps to Reproduce
Purchase/enable subscription and create Note-A.
Encrypt Note-A with a password.
Confirm: You cannot edit title/content without entering password.
Create another note (Note-B) (non-encrypted).
Intercept a request while editing Note-B.
Modify the request:
Replace {note_id} with the ID of Note-A (encrypted note).
Example request:
PATCH /v4/notes/ac62e556-3582-11f1-95c7-fd098cc2f8b1
{"name":"note encryption bypass"}
Send the request.
Observe:
The encrypted note’s title is updated without a password.
Impact
Bypasses encryption protection mechanism.
Unauthorized modification of protected notes.
Breaks core confidentiality and integrity guarantees.
Could be extended to:
Modify sensitive metadata
Potentially tamper with protected content
Undermines user trust in encrypted notes feature.
Expected Behavior
Any modification to encrypted notes should require:
Password verification
Server-side validation of encryption state
Requests without proper authorization should be rejected.
Actual Behavior
Server accepts modification requests without verifying encryption/password.
Encrypted note metadata can be altered freely.
Recommendation
Enforce server-side validation for encrypted notes.
Require password/token verification before:
Editing title
Editing content
Any metadata updates
Bind encryption state checks directly to backend logic.
Do not rely on client-side enforcement.
Additional Note
This vulnerability indicates that encryption protections are not fully enforced at the API level, which may affect other encrypted operations.