Summary
The login functionality is vulnerable to Login Cross-Site Request Forgery (Login CSRF). An attacker can force a victim's browser to authenticate into an attacker-controlled account without the victim's knowledge. If the login request lacks adequate CSRF protection (such as validating a login-specific CSRF token or request origin), the victim may unknowingly interact with the attacker's account instead of their own. Amplenote uses a dedicated authentication service hosted at login.amplenote.com.
Affected Endpoint
URL: https:
Description
The login endpoint accepts authentication requests without sufficient protection against cross-site request forgery.
An attacker can create a webpage containing a form that automatically submits the attacker's own login credentials to the Amplenote login endpoint. If a victim visits this malicious page, their browser authenticates them into the attacker's account.
Although the attacker does not gain direct access to the victim's account, this can result in:
The victim unknowingly storing or creating data inside the attacker's account.
Leakage of sensitive information entered by the victim.
Confusion during subsequent account operations.
Facilitation of phishing or social engineering attacks.
Steps to Reproduce
Create an attacker-controlled Amplenote account.
Capture the login request using Burp Suite.
Verify that the login request does not require a valid anti-CSRF token or equivalent protection.
Create a malicious HTML page that automatically submits the attacker's login credentials.
Ensure the victim is logged out of Amplenote.
Convince the victim to visit the malicious webpage.
The victim is automatically logged into the attacker's account.
Any notes or information the victim creates are stored in the attacker's account.
Proof of Concept
<html>
<body onload="document.forms[0].submit()">
<form action="https://login.amplenote.com/login" method="POST">
<input type="hidden" name="email" value="attacker@example.com">
<input type="hidden" name="password" value="AttackerPassword123!">
</form>
</body>
</html>
Security Impact
An attacker may be able to:
Force victims to authenticate into an attacker-controlled account.
Trick victims into entering confidential notes or sensitive information into the attacker's account.
Perform phishing or impersonation attacks.
Cause user confusion regarding account ownership.
Increase the likelihood of credential disclosure through subsequent social engineering.
Business Impact
Loss of user trust.
Exposure of confidential user information.
Increased phishing opportunities.
Higher customer support burden due to account confusion.
Reputational damage.
Remediation
Require a cryptographically secure CSRF token on the login form.
Validate the Origin and Referer headers for login requests.
Use SameSite=Lax or SameSite=Strict cookies where appropriate.
Regenerate the session identifier after successful authentication.
Notify users when a new login session is created from an unfamiliar device or location.
References
CWE-352: Cross-Site Request Forgery (CSRF)
OWASP: Cross-Site Request Forgery Prevention Cheat Sheet
OWASP: Login CSRF