HTML Injection via Image Tag in Public Notes Leading to Content Spoofing

linkResolution: ✅

Fixed

Reduced payout due to:

Not reproducible as described in report

Limited impact due to length limit and partial sanitization


linkReport

Summary
An HTML injection vulnerability exists in Amplenote public notes that allows an attacker to inject arbitrary HTML tags (specifically <img>) into a note. This input is rendered on the public-facing note page, allowing attackers to display external images and spoof content such as fake promotions, “free gifts,or phishing-style messages.
 
This can be abused to mislead users viewing public notes.
 
Affected URL
Example public note:
 
https://www.amplenote.com/notes/eb5735a4-3632-11f1-9174-2334d1d0077d
Rendered public view:
 
https://public.amplenote.com/UdwCT1fnihJGvcXwYGs7AdVN
Vulnerability Type
Stored HTML Injection
 
Content Injection / UI Spoofing
 
Steps to Reproduce
1. Create or edit a note
Go to:
 
https://www.amplenote.com/notes/eb5735a4-3632-11f1-9174-2334d1d0077d
2. Inject HTML image payload
Insert the following into the note content:
 
<img src="https://example.com/fake-gift.png">
(or any external image URL)
 
Example malicious usage:
 
<img src="https://example.com/free-gift.png">
3. Publish note
Make the note public.
 
4. Open public URL
Visit:
 
https://public.amplenote.com/UdwCT1fnihJGvcXwYGs7AdVN
Actual Result
Injected <img> tag is rendered in the public note
 
External image loads successfully
 
Attacker-controlled content is displayed inside trusted Amplenote domain
 
Expected Result
HTML tags should be sanitized or escaped
 
Only safe Markdown content should be rendered
 
External HTML injection should not be possible
 
Security Impact
This vulnerability enables:
 
⚠️ Content Spoofing
Attackers can inject:
 
Fake “Free gift” banners
 
Fake promotional images
 
Fake warnings or phishing content
 
⚠️ Trust Abuse
Content appears under official Amplenote domain
 
Users may trust malicious content due to domain legitimacy
 
⚠️ Social Engineering Risk
Can be used to trick users into clicking external malicious links
 
Severity
Medium
 
Recommendation
Properly sanitize all user input in notes
 
Escape HTML tags in public rendering layer
 
Restrict <img> to allow only safe, validated sources
 
Implement a strict Content Security Policy (CSP) for public note pages
 
Consider Markdown-only rendering without raw HTML support
 
Additional Notes
This issue is exploitable on publicly shared note pages and does not require authentication once the note is published.
 
Proof of Concept
Inject <img> tag in note content
 
Publish note
 
Open public URL image renders successfully