Description

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T13:17:28.613Z",
  "pubdate": "2026-10-12T13:17:28.613Z",
  "executiveSummary": "TDuck survey form through version 6.0 is susceptible to a broken access control vulnerability residing in the field creation mechanism. The flaw permits authenticated users to manipulate the form structure of other users by injecting arbitrary fields into a target's public-facing survey. This security failure stems from insufficient server-side authorization checks during batch processing of form items. An attacker can exploit this by crafting a malicious POST request that targets the endpoint responsible for creating form fields. The impact includes the potential for unauthorized data collection, phishing, cross-site scripting (XSS) if input sanitization is bypassed, or the disruption of survey integrity. Exploitation requires an authenticated account within the platform, but does not require administrative privileges. This vulnerability poses a significant risk to user data confidentiality and the overall integrity of survey workflows hosted on the affected instances.",
  "technicalDetails": "The vulnerability is localized within the POST /user/form/item/batch/create endpoint, which handles the mass creation of fields for survey forms. The root cause is a failure to implement proper authorization enforcement for individual items within the batch processing array. When the application receives a batch request, it fails to validate that the current authenticated user possesses ownership or appropriate modification rights over every formKey referenced in the provided input array.\nThe exploitation method relies on the server's processing logic, which iterates through an array of field definition objects. An attacker can construct a payload where the initial object references a form they legitimately own, effectively passing initial server-side identity checks. By appending additional objects into the same array that reference a victim's unique formKey, the attacker bypasses access control filters that only validate the request context or the first entry. This allows the unauthorized insertion of arbitrary fields, such as text boxes, file uploads, or hidden fields, into the victim's public-facing survey page.\nThe attack flow follows these distinct steps: First, the attacker identifies the victim's unique formKey through passive reconnaissance or public enumeration. Second, the attacker constructs a malicious JSON payload formatted as an array of objects. Third, the attacker initiates a POST request to /user/form/item/batch/create. Fourth, the application logic processes the array sequentially; the server validates the attacker's own formKey and proceeds to process subsequent entries without re-validating ownership for the secondary formKey. Finally, the attacker's injected fields are committed to the database and reflected immediately on the victim's public-facing survey page.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) / Broken Access Control issue. It affects all TDuck survey form versions up to and including 6.0. The exploit is executed over HTTP/HTTPS, requiring valid session credentials, but the lack of granular authorization allows the attacker to operate as a low-privileged user to modify data belonging to other users on the platform. The post-exploitation impact includes unauthorized data interception, potential redirection of users to malicious infrastructure, or structural manipulation of surveys to deceive respondents."
}