TDuck (<= 5.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tduck--5.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 19:51:40 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated Form Submission Exfiltration in TDuckhttps://feed.craftedsignal.io/briefs/2026-09-tduck-webhook-vuln/Wed, 16 Sep 2026 19:51:40 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-tduck-webhook-vuln/TDuck survey form through version 5.3 contains a vulnerability allowing authenticated attackers to attach unauthorized webhooks to arbitrary forms for data exfiltration.TDuck survey form versions 5.3 and earlier contain a critical vulnerability in the WebhookConfigController. The application fails to properly validate webhook destination URLs and lacks sufficient authorization checks to verify form ownership. This flaw allows an authenticated attacker to associate arbitrary webhook endpoints with any form within the instance. By doing so, the attacker can intercept and exfiltrate sensitive submission data as it is processed by the application. This vulnerability is significant as it facilitates the silent theft of user-provided data, potentially leading to unauthorized access to PII or internal organizational information. Impacted organizations using TDuck for data collection must identify and update instances to a patched version to prevent data exfiltration.

Impact

Successful exploitation allows authenticated attackers to exfiltrate all incoming form submissions to external or internal attacker-controlled endpoints. This impacts any organization relying on TDuck for private survey data collection, resulting in a complete breach of confidentiality for submitted form data.

Recommendation

Update TDuck to the latest patched version immediately. Monitor server-side web application logs for unusual POST requests directed toward the WebhookConfigController, specifically tracking associations of new or unknown external webhook URLs to existing forms.

]]>highadvisory