Summary
The Forgot Password functionality at https:
This allows attackers to abuse the password reset feature to perform email flooding (email bombing), causing inconvenience to users and increasing the risk of phishing or denial-of-service against email inboxes.
Affected URL:
https:
Technical Description
During testing, it was observed that the password reset endpoint accepts repeated requests for the same email address without enforcing rate limits, CAPTCHA, request throttling, cooldown periods, or other anti-automation controls.
An attacker can automate requests using tools such as Burp Suite Intruder or a simple script, causing the application to continuously send password reset emails to a target account.
Steps to Reproduce
Navigate to:
https:
Enter a valid registered email address.
Submit a password reset request.
Repeat the request multiple times manually or using an automated tool (e.g., Burp Suite Intruder).
Observe that each request generates a new password reset email without restriction.
Working Proof of Concept
Affected Endpoint
https:
Example Request
POST /forgot_password HTTP/2
Host: login.amplenote.com
Content-Type: application/x-www-form-urlencoded
email=victim@example.com
Send the above request repeatedly using Burp Suite Intruder or another automation tool.
Observed Result
Every request is accepted.
A new password reset email is generated for each request.
No rate limiting, CAPTCHA, cooldown, or temporary blocking is triggered.
Expected Result
The application should limit password reset requests per email address and IP address, and implement additional abuse prevention mechanisms.
Attack Scenario
An attacker automates thousands of password reset requests targeting a victim's email address.
As a result:
The victim's inbox is flooded with password reset emails.
Legitimate emails become difficult to locate.
Users may ignore genuine security notifications.
Attackers can combine the attack with phishing campaigns to trick victims into interacting with malicious emails.
User Impact
Email inbox flooding.
Denial of service against the user's mailbox.
Confusion caused by excessive password reset emails.
Increased likelihood of successful phishing attacks.
Poor user experience.
Business Impact
Abuse of the password reset infrastructure.
Increased outbound email costs.
Higher risk of email provider rate limiting or blacklisting.
Increased customer support requests.
Damage to brand reputation and user trust.
Remediation
Enforce rate limiting based on IP address and email address.
Introduce a cooldown period between password reset requests.
Implement CAPTCHA after repeated requests.
Detect and block automated traffic.
Log and monitor excessive password reset attempts.
Return generic responses regardless of whether an email exists to prevent abuse and user enumeration.
Consider temporarily blocking repeated requests from abusive IP addresses.
References
OWASP Forgot Password Cheat Sheet
OWASP Authentication Cheat Sheet
OWASP Automated Threats to Web Applications