| عنوان | jofpin trape latest (main/master branch) CWE-306 |
|---|
| الوصف | The SocketIO event handlers on the /trape namespace perform zero authentication. The 'join' handler allows any connected client to join any room (victim sessions are keyed by vId). The 'my_room_event' handler emits attacker-controlled data including type fields like 'redirect', 'execute', 'jscode', 'jsscript', 'alert', and 'talk' to any specified room. These message types correspond to attack actions on tracked victims (redirecting, downloading files, injecting scripts, sending voice messages). The broken business rule is that operator-only command channels to victims have no access control, allowing any network observer to hijack victim sessions or inject arbitrary commands. Exploitation: An attacker connects to the trape SocketIO endpoint at ws://target:port/socket.io (namespace /trape). They emit a 'join' event with a victim's room name (the vId, a short 5-character token visible in network traffic or guessable). They then emit 'my_room_event' with {room: victim_vId, data: {type: 'jsscript', message: 'malicious_payload'}} to inject arbitrary JavaScript into the victim's browser, or {type: 'redirect', message: 'http://evil.com'} to redirect the victim. They can also passively listen to all 'my_response' events to intercept data flowing between the operator and victims. |
|---|
| المصدر | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| المستخدم | GalaxynC (UID 98975) |
|---|
| ارسال | 18/07/2026 09:32 PM (2 أشهر منذ) |
|---|
| الاعتدال | 06/09/2026 08:24 PM (2 months later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room توثيق ضعيف] |
|---|
| النقاط | 0 |
|---|