Target:
https:
Endpoint: POST /email_change_requests
Summary:
The email change functionality on Amplenote lacks proper rate limiting, allowing an attacker to send unlimited email change requests. This can be abused to flood arbitrary users with email notifications and potentially cause denial of service or harassment.
Steps to Reproduce:
Register an account on Amplenote using any email address (no verification required).
Log in to the dashboard.
Navigate to the email change functionality.
Intercept the request:
POST /email_change_requests HTTP/2
Host: www.amplenote.com
Modify the request and insert a victim’s email address.
Send the request.
Use a tool like Burp Suite Intruder to automate sending multiple requests.
Observe that:
Emails are sent repeatedly without restriction.
Both the original and new email addresses receive notifications.
Impact:
Email Flooding (DoS): Attackers can spam victim inboxes with unlimited emails.
User Harassment: Can be used to target individuals with continuous unwanted emails.
Resource Abuse: May increase load on mail infrastructure.
Reputation Damage: Could lead to domain/email blacklisting.
Proof of Concept:
Automated repeated requests using Burp Intruder.
Multiple emails received by both original and victim email addresses without any rate limiting or CAPTCHA.
Expected Behavior:
The application should enforce strict rate limiting on email change requests and implement additional protections such as CAPTCHA or verification checks.
Recommendation:
Implement rate limiting (e.g., 3–5 requests per hour per user/IP).
Require email verification before allowing email change.
Add CAPTCHA or abuse detection mechanisms.
Log and monitor suspicious activity.
Conclusion:
The lack of rate limiting on the email change endpoint allows attackers to abuse the system for email flooding and harassment, posing a moderate security risk.