Summary
The email change functionality accepts malformed email addresses that do not conform to standard email address syntax.
During testing, the following invalid email address was accepted:
ar%r%r%r%r%R%Rrrrrr%%%rrrr@aras.nl
This indicates insufficient server-side email validation, allowing invalid email formats to be stored or processed. Proper email validation is important to ensure account integrity and reliable delivery of verification and recovery emails.
Affected URL
https:
Technical Description
The application fails to properly validate the email address format when updating the account email.
An email address containing multiple invalid % characters in the local part was accepted instead of being rejected as an invalid format.
The application should validate email addresses according to accepted standards and reject malformed input before saving or sending verification emails.
Steps to Reproduce
Log in to an Amplenote account.
Navigate to:
https:
Enter the following email address:
ar%r%r%r%r%R%Rrrrrr%%%rrrr@aras.nl
Submit the email change request.
Observe that the application accepts the malformed email address.
Working Proof of Concept
Affected Endpoint
https:
Payload
ar%r%r%r%r%R%Rrrrrr%%%rrrr@aras.nl
Observed Result
The application accepts the malformed email address.
Validation does not reject the invalid format.
Expected Result
The application should reject malformed email addresses.
A validation error such as "Please enter a valid email address." should be displayed.
Server-side validation should enforce proper email syntax before updating the account.
Attack Scenario
An attacker or user submits malformed email addresses that bypass client-side validation.
This can lead to:
Invalid account contact information.
Failure to receive verification or password reset emails.
Data integrity issues within the user database.
Potential abuse if downstream systems assume the email format is valid.
User Impact
Users may lose access to account recovery emails.
Verification emails may never be delivered.
Incorrect account information may be stored.
Business Impact
Increased support requests for account recovery.
Reduced reliability of email-based authentication workflows.
Data quality issues within the user database.
Potential inconsistencies across integrated services that expect valid email addresses.
Remediation
Perform strict server-side email validation.
Reject malformed email addresses that do not comply with accepted email syntax.
Do not rely solely on client-side validation.
Normalize and validate email input before storing it.
Verify ownership of the new email address before updating the account.
References
OWASP Input Validation Cheat Sheet
OWASP Authentication Cheat Sheet
RFC 5322 / RFC 5321 email address syntax guidance