Summary
The password reset functionality at https:
As a result, an attacker can automate large numbers of password reset requests against arbitrary user accounts, leading to email flooding, user annoyance, potential denial of service against users' inboxes, and facilitating phishing or social engineering attacks.
Technical Description
The Forgot Password endpoint accepts password reset requests without requiring CAPTCHA or another bot mitigation mechanism.
Because there is no human verification step, automated tools or scripts can continuously submit password reset requests for a victim's email address.
This allows attackers to abuse the password reset functionality by generating excessive password reset emails, potentially overwhelming the victim's mailbox and disrupting legitimate use of the account.
Steps to Reproduce
Navigate to:
https:
Enter a valid registered email address.
Submit the password reset request.
Observe that no CAPTCHA or bot verification is required.
Repeat the request manually or using an automated script.
Multiple password reset emails are generated for the same account.
Working Proof of Concept
Target
https:
Proof
Visit the Forgot Password page.
Enter a valid email address.
Submit the request.
No CAPTCHA challenge is displayed.
Repeated submissions continue to trigger password reset emails.
Example automated request:
POST /forgot_password HTTP/1.1
Host: login.amplenote.com
Content-Type: application/x-www-form-urlencoded
email=victim@example.com
The request can be repeated multiple times because no CAPTCHA mechanism prevents automated abuse.
Attack Scenario
An attacker writes a simple script that repeatedly submits password reset requests using a victim's email address.
Within minutes, hundreds of password reset emails may be delivered to the victim.
This can:
Flood the victim's inbox.
Hide legitimate emails.
Cause confusion regarding account security.
Increase the likelihood that the victim falls for phishing emails disguised as legitimate password reset notifications.
User Impact
Password reset email flooding.
Inbox denial-of-service.
User confusion regarding account compromise.
Increased susceptibility to phishing attacks.
Poor user experience.
Business Impact
Abuse of email infrastructure.
Increased mail delivery costs.
Customer support burden due to reset email complaints.
Potential reputational damage.
Increased effectiveness of phishing campaigns targeting users.
Remediation
Implement multiple anti-automation controls, including:
Require CAPTCHA (e.g., reCAPTCHA or Cloudflare Turnstile) after one or more password reset attempts.
Implement IP-based and account-based rate limiting.
Apply request throttling and temporary lockouts for excessive requests.
Monitor for abnormal password reset activity.
Log and alert on automated password reset abuse.
Consider requiring additional verification before sending excessive password reset emails.
These measures will significantly reduce the risk of automated password reset abuse while maintaining usability for legitimate users.