No validation on account names

[bohdan-shulha]

Reported by Kunal Mhaske [email protected]

Vulnerability Name: No validation on account names

Vulnerable URL: https://ctl.ptah.sh/user/profile

Description:
Account name text fields have no validation and any characters can be used to save the name. This can be used for malicious purposes. a complete malicious link can be saved in this textboxes and when you send users an invitation to join new relic account, this names will render as valid link in email clients.for eg if i save account name as some porn site, it will render as link in email client.since the email is from trusted domain like new relic, victim will definitely want to click on the link which will end up him visiting some porn site.See the attached screenshot. For eg purpose i used http://google.com/ as name.

Steps:

1. Login in to the account.
2. go to profile.
3. In the name field type https://gooogle.com/ and save it

Impact:
No validation on account names