Summary
The First Name and Last Name fields on the profile page accept arbitrary emoji characters without any validation or sanitization. This allows users to register or update their profile using names consisting entirely of emojis instead of legitimate alphabetic characters.
While emojis themselves do not execute code, accepting unrestricted emoji-only names can lead to identity confusion, user impersonation, profile integrity issues, inconsistent application behaviour, and downstream processing problems in systems that expect human-readable names.
Vulnerability Description
The application does not properly validate the content of the First Name and Last Name fields.
Instead of restricting input to valid human names (letters, spaces, apostrophes, hyphens, etc.), the application allows users to submit names containing only emoji characters.
Example payload used:
😀 😃 😄 😁 😆 😅 😂 🤣 😊 😇 😉 😍 😘 😎 🤔 😴 😡 😱 😭 🤯
The profile is successfully updated without any validation error.
This demonstrates insufficient server-side validation of identity-related fields.
Steps to Reproduce
Login to your Amplenote account.
Navigate to:
https:
Edit the First Name field.
Edit the Last Name field.
Enter the following payload:
😀 😃 😄 😁 😆 😅 😂 🤣 😊 😇 😉 😍 😘 😎 🤔 😴 😡 😱 😭 🤯
Save the profile.
Observe that the application accepts the input and updates the profile successfully.
Proof of Concept
First Name
😀 😃 😄 😁 😆 😅 😂
Last Name
🤣 😊 😇 😉 😍 😘 😎 🤔 😴 😡 😱 😭 🤯
Result:
Profile updated successfully.
Emoji-only names are displayed throughout the application.
Expected Behaviour
The application should validate identity fields by:
Allowing alphabetic characters.
Allowing legitimate punctuation used in names.
Rejecting emoji-only values.
Rejecting unsupported Unicode symbols where appropriate.
Performing identical validation on both client-side and server-side.
Actual Behaviour
The application accepts emoji characters as valid names and stores them in the user profile.
Security Impact
Although this is not a code execution vulnerability, unrestricted emoji input in identity fields may introduce several security and operational issues:
Users can create misleading or non-human identities.
Increased risk of impersonation or social engineering.
Confusing account listings, comments, mentions, and shared notes.
Potential issues with search, sorting, exports, reporting, and integrations.
Possible compatibility problems with third-party systems that expect standard name formats.
Reduced data integrity and audit reliability.
Business Impact
Failure to validate identity-related fields can affect platform trust and data quality by:
Allowing fake or misleading user identities.
Complicating customer support and account verification.
Reducing professionalism in collaborative workspaces.
Introducing malformed data into analytics, exports, and integrations.
Increasing moderation and administrative overhead.
Remediation
Implement strict server-side validation for profile name fields by:
Accepting only characters appropriate for personal names.
Rejecting emoji-only and unsupported Unicode symbol inputs.
Enforcing reasonable length limits.
Normalising Unicode input before validation.
Applying identical validation across all endpoints that update profile information.
CVSS v3.1 (Suggested)
Score: 4.3 (Medium)
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Conclusion
The profile update functionality does not properly validate the First Name and Last Name fields, allowing users to save emoji-only names. While this does not directly lead to code execution, it weakens identity validation, reduces data integrity, and can facilitate impersonation or abuse scenarios. Implementing strict server-side validation for identity fields will improve the application's reliability and security.