Unauthenticated RCE in dedoc/scramble documentation generation

This repository is a deliberately vulnerable Laravel lab application built to demonstrate the dedoc/scramble RCE issue referenced as CVE / GHSA-4rm2-28vj-fj39. It is not a standalone exploit script; instead, the repository itself is the vulnerable target environment and proof-of-concept setup. Structure: the project is a minimal Laravel app with standard bootstrap, config, public, routes, and migration files. The key files are lab/app/Http/Controllers/ProductController.php, lab/routes/api.php, and lab/config/scramble.php. composer.json pins dedoc/scramble to 0.13.21 and laravel/framework to ^13.7, confirming the intended vulnerable dependency set. Main exploit capability: ProductController::index contains the intentionally unsafe pattern described in comments. A local variable named $code is assigned from user input via $request->input('sort', 'required|string'); then reused as a validation rule in $request->validate(). The comments explain that Scramble, during documentation generation, performs extract($variables) before eval("return $code;"). Because tracked variables include ['code' => attacker-controlled value], the attacker can overwrite Scramble's internal $code variable and cause arbitrary PHP evaluation. This yields remote code execution when the docs generator processes the route. Exposure and trigger surface: API routes are defined under /api/v1, especially GET /api/v1/products which maps to the vulnerable index() method. Scramble is configured with api_path='api', export_path='api.json', and middleware=['web']; comments explicitly note that restricted docs access was removed intentionally so docs are public. The comments also reference /docs/api as the documentation home page. Together, this indicates the vulnerable route is intended to be reachable and introspected by public documentation generation endpoints. Other repository contents are mostly stock Laravel configuration and migrations. No separate exploit client, shell dropper, reverse shell, or post-exploitation automation is included. Therefore the repository is best classified as a proof-of-concept vulnerable lab rather than a weaponized exploit package.

This repository is a real exploit project for CVE-2026-44262, an unauthenticated RCE in dedoc/scramble affecting versions >=0.13.2 and <0.13.22. The main artifact is a standalone Python exploit script, CVE-2026-44262.py, which uses only the Python standard library. It targets the public Scramble OpenAPI endpoint /docs/api.json, first verifying accessibility, then parsing the returned OpenAPI document to identify suspicious query parameters whose default values resemble Laravel validation rules. That heuristic is used to find the parameter likely mapped to the vulnerable $code variable pattern described in the advisory. The exploit supports both detection and active exploitation. Detection includes a safe timing probe using sleep(4) to confirm that attacker-controlled input reaches eval(). Active exploitation paths include arbitrary command execution, arbitrary PHP execution, arbitrary file read, OS detection, bulk scanning of multiple targets, and a reverse shell using PHP proc_open. The script also fingerprints response headers such as Server, X-Powered-By, and cookies including XSRF-TOKEN and session cookies. It disables TLS verification, normalizes targets, and appears designed for direct operator use rather than framework integration. The repository also includes two auxiliary detection artifacts: a Nuclei template (CVE-2026-44262.yaml) and an Nmap NSE script (http-scramble-rce-detect.nse). Both are detection-focused and use the same two-stage logic: fetch /docs/api.json, identify a likely vulnerable query parameter, then send a timing payload sleep(4) to confirm code execution without destructive actions. A substantial docker/ directory provides a self-contained Laravel lab environment. The Dockerfile builds a PHP 8.4 Alpine container, installs Composer, and launches a Laravel app on port 8000. The lab application intentionally includes dedoc/scramble 0.13.21 in composer.json and exposes public docs. The vulnerable pattern is implemented in docker/lab/app/Http/Controllers/ProductController.php, where request input sort is assigned to $code and then used in $request->validate(). Routes under /v1/products are present so Scramble will document them, making /docs/api.json exploitable in the lab. This lab confirms the repository’s purpose: provide a working PoC exploit plus safe scanners and a reproducible vulnerable environment. Overall structure: root-level exploit script, root-level Nuclei and NSE detectors, documentation files, and a Dockerized Laravel proof lab. The repository is not merely a detector or README; it contains operational exploit code with multiple post-exploitation capabilities.