Hyperlink Injection in Profile Name Field
Reporter: Fatima
Severity: High
Summary
The profile Name field on the Amplenote profile page allows users to enter a URL such as https:
Affected URL:
https:
Technical Description
During testing, it was observed that the Name field does not properly sanitize user-controlled input containing URLs. When a value such as https:
User-controlled profile fields should generally be displayed as plain text unless hyperlink functionality is explicitly intended and properly validated. Rendering arbitrary URLs may facilitate phishing, social engineering, and the distribution of malicious content.
Steps to Reproduce
Log in to an Amplenote account.
Navigate to:
https:
Edit the Name field.
Enter the following payload:
https:
Save the profile.
View the updated profile.
Observe that the URL is rendered as a clickable hyperlink.
Working Proof of Concept
Affected Endpoint
https:
Payload
https:
Observed Result
The application accepts the payload and displays it as a clickable hyperlink.
Expected Result
The Name field should only display plain text. URLs should either be rejected, sanitized, or encoded so they cannot become active hyperlinks unless this behavior is explicitly intended and securely implemented.
Attack Scenario
An attacker creates an account and changes their profile name to a malicious URL such as:
https:
If the profile name is displayed anywhere other users, collaborators, or administrators can view it, users may trust and click the link, leading to:
Credential phishing pages.
Malware downloads.
Fake login portals.
Social engineering attacks.
Redirection to attacker-controlled websites.
User Impact
Users may be redirected to malicious websites.
Increased risk of credential theft.
Potential malware infections.
Loss of user trust.
Business Impact
Increased phishing risk through trusted user profiles.
Damage to platform reputation.
Potential abuse for spam campaigns.
Increased support and incident response efforts.
Remediation
Treat profile names strictly as plain text.
HTML-encode all user-controlled input before rendering.
Do not automatically convert URLs in profile names into clickable hyperlinks.
Validate profile names against an expected character set.
Apply context-aware output encoding throughout the application.
Review all profile fields for similar rendering issues.
References
OWASP Cross-Site Scripting Prevention Cheat Sheet
OWASP Input Validation Cheat Sheet