Missing Authorization in TDuck Survey Form Allows Unauthorized Access

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in TDuck Survey Form through version 5.3. It allows any authenticated user to access other users' raw form settings via the endpoint GET /user/form/setting/{key}. Attackers can supply an 8-character form key from a public survey link to retrieve sensitive details like the form write password, owner notification email, and WeChat OpenIDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your TDuck Survey Form instance allows unauthorized access to form settings via GET /user/form/setting/{key}. Use authenticated requests with different user accounts to test if raw settings (including write passwords) are exposed when supplying an 8-character form key from public links.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive form settings, including the write password, allowing them to modify or delete forms. They could also obtain owner notification emails and WeChat OpenIDs, potentially leading to further phishing or data breaches. The impact includes compromised form integrity and potential exposure of user data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. It may result in non-compliance with data confidentiality and access control mandates, potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TDuck Survey Form to version 6.0 or later, which includes ownership validation for the GET /user/form/setting/{key} endpoint. If updating is not possible, restrict access to authenticated users only and implement server-side checks to ensure users can only access their own form settings.

Useful 0 Not Useful 0