Summary
The password change functionality is vulnerable to Cross-Site Request Forgery (CSRF). An authenticated user can be forced to submit a forged password change request without their knowledge or consent if the endpoint does not properly validate anti-CSRF protections. Password changes are among the most sensitive account operations and should always require strong CSRF defences. Amplenote exposes account management features through its Account Settings interface.
Affected Endpoint
URL: https:
Description
The application accepts authenticated password change requests without properly validating a unique anti-CSRF token and/or the request Origin or Referer headers.
An attacker can host a malicious web page that automatically submits a forged password change request while the victim is logged into Amplenote. Since the victim's browser automatically includes authenticated session cookies, the server may process the request as if it originated from the legitimate user.
If additional confirmation (such as entering the current password) is not required or is improperly validated, the attacker can change the victim's password without their knowledge.
Steps to Reproduce
Log in to your Amplenote account.
Navigate to:
https:
Intercept the password change request using Burp Suite.
Verify that the request can be replayed without a valid CSRF token or that no Origin/Referer validation is performed.
Create a malicious HTML page that automatically submits the same request using attacker-controlled password values.
While remaining logged in, visit the malicious webpage.
The browser automatically submits the forged request using the victim's authenticated session.
The account password is changed without the victim intentionally performing the action.
Proof of Concept
<html>
<body onload="document.forms[0].submit()">
<form action="https://www.amplenote.com/account/password" method="POST">
<input type="hidden" name="current_password" value="CurrentPassword">
<input type="hidden" name="new_password" value="AttackerPassword123!">
<input type="hidden" name="confirm_password" value="AttackerPassword123!">
</form>
</body>
</html>
Security Impact
A successful attack may allow an attacker to:
Change the victim's account password.
Lock the legitimate user out of their account.
Prevent the victim from accessing their notes and stored information.
Facilitate complete account takeover when combined with other weaknesses.
Cause loss of user trust and compromise the integrity of user accounts.
Business Impact
Account compromise.
Unauthorized access to sensitive user data.
Increased account recovery requests.
Reputational damage.
Potential regulatory and privacy implications if user data is exposed.
Remediation
Require a cryptographically secure anti-CSRF token for all password change requests.
Validate the Origin and Referer headers.
Require the current password before accepting a password change.
Use SameSite=Lax or SameSite=Strict session cookies where appropriate.
Invalidate all active sessions after a successful password change.
Notify the registered email address whenever a password change occurs.
References
CWE-352: Cross-Site Request Forgery (CSRF)
OWASP Cross-Site Request Forgery Prevention Cheat Sheet