Summary
The password reset request functionality is vulnerable to Cross-Site Request Forgery (CSRF). The endpoint responsible for initiating password reset emails accepts cross-site requests without adequate CSRF protection, allowing an attacker to cause a victim's browser to submit a password reset request without the victim's knowledge. Amplenote provides a dedicated password reset endpoint for account recovery.
Affected Endpoint
URL: https:
Description
The application processes password reset requests without validating a cryptographically secure anti-CSRF token and/or verifying the Origin or Referer headers.
An attacker can host a malicious webpage that automatically submits a password reset request to the vulnerable endpoint. If the victim visits the attacker's page, their browser will send the forged request. Although this does not directly reset the password, it can trigger unsolicited password reset emails, enabling email flooding, user confusion, and support abuse.
Steps to Reproduce
Navigate to the password reset page.
Intercept the password reset request using Burp Suite.
Verify that the request does not require a valid CSRF token or origin validation.
Create a malicious HTML page that automatically submits a password reset request for a target email address.
Visit the malicious page.
Observe that the password reset request is processed and a reset email is generated.
Proof of Concept
<html>
<body onload="document.forms[0].submit()">
<form action="https://login.amplenote.com/forgot_password" method="POST">
<input type="hidden" name="email" value="victim@example.com">
</form>
</body>
</html>
Impact
An attacker may be able to:
Trigger unsolicited password reset emails.
Cause email flooding against targeted users.
Confuse users into believing their account is under attack.
Increase customer support workload.
Combine the issue with phishing or social engineering campaigns.
Business Impact
Poor user experience due to unwanted password reset emails.
Increased support requests.
Potential abuse for email flooding or harassment.
Reduced trust in the platform's account recovery process.
Remediation
Require a unique anti-CSRF token for password reset requests.
Validate the Origin and Referer headers.
Apply rate limiting and abuse detection to password reset requests.
Consider implementing CAPTCHA after repeated requests from the same source.
Log and monitor abnormal password reset activity.
References
CWE-352: Cross-Site Request Forgery (CSRF)
OWASP Cross-Site Request Forgery Prevention Cheat Sheet