CVE-2026-100306

Executive Summary

CVE-2026-100306 is a client-side enforcement weakness (CWE-602) in TDuck survey forms through version 6.0, where write passwords designed to gate form submissions are validated only in the browser front end and not on the server-side submission endpoints. Any remote, unauthenticated attacker who obtains a form key from a public share link can submit entries directly to the public submission APIs, bypassing the password protection entirely. The result is unauthorized data injection into forms that operators believed were password-protected, enabling spam, poisoning of survey results, and potential downstream abuse of any automated workflows consuming that submission data.

Technical Analysis

The vulnerability class here is CWE-602: Client-Side Enforcement of Server-Side Security. In this anti-pattern, an application places a security control—here, a "write password" required to submit a form—entirely in code executing in the user's browser. The server endpoints that actually accept and persist submissions do not re-validate the credential.

Two distinct trust boundaries are conflated in this design:

1. The presentation layer (front end): A survey form rendered in a browser may prompt the user for a write password before allowing submission. This check lives in JavaScript or equivalent client-side logic and is fully under attacker control—it can be disabled, skipped, or never loaded at all.
2. The submission API (back end): Public HTTP endpoints accept form entries. According to the NVD description, these endpoints "fail to validate write passwords on submission," meaning the password is not part of the authorization decision server-side.

Because the submission API is intentionally reachable by unauthenticated users—survey respondents are, by definition, anonymous—the endpoint is public by design. The only thing standing between an attacker and the write function was the front-end password prompt. Removing that prompt from the equation by calling the API directly eliminates the protection.

The attack surface is the public submission API. The NVD description explicitly notes that the form key from share links is all an attacker needs. A form key functions as a public identifier, not a secret—it is embedded in any share link distributed to respondents. Consequently, there is effectively no secret an attacker must steal before submitting. Reconnaissance reduces to finding a vulnerable instance and harvesting a share link.

No code-level specifics—such as the exact API path, parameter names, or the hashing/serialization of the password—are provided in the available CVE data. What can be stated precisely is the mechanism: the server performs no validation of the write password at the submission endpoint, so the protection is cosmetic. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) is consistent with this reading: network-exploitable, no privileges or user interaction required, and impact confined to integrity (unauthorized submissions), with no confidentiality loss and no availability impact.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level from the NVD description. Only concepts named in that description (form key, share link, public submission APIs, write password) are used.

1. Reconnaissance and target identification. An attacker identifies internet-exposed TDuck deployments, for example via web-content search engines or direct scanning of hosts serving TDuck survey pages. For each candidate, the attacker locates a share link—these are meant to be distributed to respondents and are frequently posted publicly, embedded in campaigns, or guessable across a predictable instance.
2. Key extraction. From the share link, the attacker extracts the form key. This is the sole credential the NVD description identifies as required. No write password is obtained; it is not needed.
3. Direct submission (triggering the flaw class). Instead of completing the front-end form—where the write password prompt would appear—the attacker issues requests directly to the public submission API, supplying the form key and attacker-chosen entry data. Because the server does not validate the write password on the submission endpoint, the request is accepted as if it had come from a legitimately authorized respondent. The client-side password check is simply never in the request path.
4. Post-exploitation impact. The attacker can submit arbitrary entries, potentially at volume, into forms the operator believed were protected. Depending on how the deployment consumes submissions, secondary effects may include polluting analytics, injecting unwanted content into exported datasets, triggering email or webhook notifications built around new submissions, or skewing decisions made from survey data. No code execution, privilege escalation, or data exfiltration is indicated by the CVSS vector or description; the demonstrated impact is unauthorized write/integrity violation.

Automation is trivial: once the form key and submission endpoint are known, the loop is a simple repeated HTTP POST. Rate limiting or submission deduplication controls, if present, are the only practical friction and are outside the description of this CVE.

Impact Assessment

The CVSS v3.1 base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. Interpreting each metric against the described flaw:

• AV:N (Network) — the submission API is remotely reachable, as it must be to accept respondent input.
• AC:L (Low) — exploiting the flaw requires only a share-link form key and a direct API call; no special conditions.
• PR:N (None) — the attacker requires no account, since submissions are accepted from unauthenticated respondents.
• UI:N (None) — no victim user must interact; the attacker acts directly against the API.
• S:U (Unchanged) — impact stays within the authorization scope of the vulnerable component.
• C:N (None) — no data is disclosed by the flaw itself.
• I:L (Low) — the attacker can create/modify form entries, a limited integrity impact rather than wholesale data compromise.
• A:N (None) — no degradation of availability is described.

Blast radius: any TDuck deployment ≤ 6.0 that relies on write passwords to restrict submissions to the intended audience. Organizations using TDuck for gated surveys—internal polls, access-controlled feedback, lead-gated forms—lose the guarantee those passwords were meant to provide; the protection is illusory against anyone who can read the share link, which is everyone the link was sent to (and anyone who obtains it thereafter).

Business impact: low-severity but real. The primary risks are data-integrity contamination, spam/abuse injection, and erosion of trust in collected results. In regulated or decision-support contexts, poisoned survey data can propagate into reporting. The absence of confidentiality and availability impact keeps this from being a critical exposure, but it fully negates a security control operators likely documented as a compensating measure.

Detection Guidance

Sigma Rule

This rule targets the misconfigured-client-behavior pattern at the application layer: submission API access that does not correlate with a preceding form-render/password-challenge flow. Because no concrete endpoint names are published, the rule uses generic HTTP request semantics and should be tuned with the organization's actual TDuck submission path.

title: TDuck Survey Form Write-Password Bypass - Direct Submission API Access
id: 7c2e9a1f-3d54-4b8a-9e10-5tf1duckcve
status: experimental
description: Detects direct POST requests to TDuck survey submission APIs without an accompanying write-password validation flow, consistent with CVE-2026-100306 client-side enforcement bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100306
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-100306
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-stem|contains:
      - '/api/'
      - '/submit'
      - '/form'
  selection_ua:
    cs-user-agent|contains:
      - 'curl'
      - 'python'
      - 'python-requests'
      - 'Go-http-client'
      - 'PostmanRuntime'
      - 'okhttp'
  filter_known_ui:
    cs-referer|contains: 'td-uck'
  condition: selection_method and selection_path and selection_ua and not filter_known_ui
falsepositives:
  - Legitimate API integrations and automated form tooling
  - Accessibility clients or embedded widgets that omit the referer header
level: medium

YARA Rule

Because the flaw lives in server behavior rather than in a file signature, this YARA rule scans deployed TDuck front-end artifacts and server-side source for the anti-pattern: a front-end-only password prompt with no corresponding server validation reference. It is heuristic and intended for source/asset review, not live memory scanning. Placeholder identifiers are avoided; matching is on generic constructs.

rule CVE_2026_100306_TDuck_ClientSide_Password_Only
{
    meta:
        description = "Heuristic detection of TDuck survey forms (<=6.0) enforcing write password only client-side (CWE-602 / CVE-2026-100306)"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100306"
        cwe = "CWE-602"
        severity = "medium"

    strings:
        $pw1 = "writePassword" ascii nocase
        $pw2 = "write_password" ascii nocase
        $pw3 = "write-password" ascii nocase
        $pw4 = "提交密码" ascii wide
        $fe1 = "onSubmit" ascii nocase
        $fe2 = "beforeSubmit" ascii nocase
        $fe3 = "validatePassword" ascii nocase
        $api1 = "submitApi" ascii nocase
        $api2 = "/submit" ascii nocase
        $key1 = "formKey" ascii nocase
        $key2 = "form_key" ascii nocase

    condition:
        (any of ($pw*)) and (any of ($key*)) and (any of ($api*) or any of ($fe*))
}

Suricata IDS Rule

The rule flags suspicious direct POSTs to survey submission paths from non-browser user agents, consistent with scripted abuse of the submission API. Tune the content paths to the fielded TDuck deployment.

alert http any any -> any any (msg:"CVE-2026-100306 TDuck Survey Form Write-Password Bypass - Direct Submission API Access"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/"; http.user_agent; content:"curl"; http.user_agent; content:"python"; pcre:"/User-Agent\x3a\x20(?:curl|python|Go-http-client|okhttp|PostmanRuntime)/Hi"; reference:cve,2026-100306; classtype:attempted-recon; sid:2026100306; rev:1;)

Elastic Detection

EQL query correlating scripted submission attempts against form-submission endpoints with an absence of browser-typical referer, indicating the client-side password flow was skipped.

http where event.action == "POST"
  and (
    url.path : ("/api/*", "/submit*", "/form*")
  )
  and user_agent.original : ("*curl*", "*python*", "*Go-http-client*", "*okhttp*", "*PostmanRuntime*")
  and not http.request.headers.referer : "*td-uck*"

Splunk SPL Query

Detects bursts of unauthenticated POSTs to submission endpoints with scripted user agents, a signature of automated write-password-bypass submissions.

index=web sourcetype=access_combined
| eval ua=lower(useragent), uri=lower(uri)
| where method="POST" AND (like(uri,"%/api/%") OR like(uri,"%submit%") OR like(uri,"%form%"))
| where match(ua,"(curl|python|go-http-client|okhttp|postmanruntime)")
| stats count values(uri) as endpoints dc(uri) as endpoint_count values(clientip) as src_ips by clientip, ua
| where count > 20
| sort - count
| table clientip, ua, count, endpoint_count, endpoints, src_ips

Wazuh OSSEC Rule

Wazuh rule matching the web access log pattern for direct submission-API abuse, mapping to the CVE for correlation.

<group name="web,td_uck,">
  <rule id="100306" level="7">
    <if_sid>31100</if_sid>
    <field name="url">/api/|/submit|/form</field>
    <regex>POST</regex>
    <regex type="pcre2">(?i)(curl|python|Go-http-client|okhttp|PostmanRuntime)</regex>
    <description>CVE-2026-100306: Possible TDuck survey form write-password bypass - direct submission API access with scripted client</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100306,attack,t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). At the time of writing there is no vendor fix, no OSV package mapping, and no official advisory identified. Do not assume an update resolves this until the vendor confirms.

1. Immediate mitigations
   • Do not rely on the write password as a security control anywhere it currently gates submissions. Treat any password-protected TDuck form (≤ 6.0) as publicly submittable.
   • Enforce access control at a layer you control: place the TDuck instance behind an authenticating reverse proxy, IP allow-list, or VPN for any form whose submissions must be restricted.
   • Add rate limiting and deduplication on the submission path to raise the cost of automated abuse, and alert on anomalous submission velocity.
   • If gated surveys are externally exposed and cannot be fronted by an authenticating layer, suspend their use until fixed.
2. Patch / upgrade steps
   • Monitor the vendor's release channel and the NVD entry (CVE-2026-100306) for an official fix. When an update is published, verify that server-side write-password validation is enforced at the submission endpoint before declaring remediation complete, and upgrade all instances ≤ 6.0.
   • Validate any candidate patch by submitting directly to the API without the password; a properly fixed server must reject the request.
3. Long-term hardening
   • Apply the principle that all security decisions are enforced server-side; never implement authorization solely in client code (CWE-602). Add this to secure-design review checklists.
   • Ensure form keys are treated as public identifiers, not secrets, and that any gating credential is validated on every write endpoint.
   • Include integrity-focused testing for public write APIs (authorization bypass, replay, bulk injection) in pre-deployment QA.

References

• NVD — CVE-2026-100306: https://nvd.nist.gov/vuln/detail/CVE-2026-100306
• CWE-602: Client-Side Enforcement of Server-Side Security — https://cwe.mitre.org/data/definitions/602.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — not yet scored for this CVE (no EPSS value available at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-100306 is NOT listed at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code was identified. No exploit-in-the-wild activity, threat actor campaign, or CISA KEV association is known for this CVE as of the reporting date. The attack chain described is inferred from the vulnerability class (CWE-602) and the NVD description only.