| عنوان | jofpin trape latest (main/master branch) CWE-613 |
|---|
| الوصف | The login endpoint validates trape.stats_key, but none of the protected admin endpoints (/get_data, /get_preview, /get_requests, /get_socialimpact, /<remove_path>, /pn) verify that the caller has authenticated. No session token, cookie, or server-side auth state is established or checked. Authentication is purely cosmetic — the only thing gating the admin APIs is path obfuscation, and the /login response itself leaks every protected path (home_path, remove_path, etc.) to whoever supplies the key. The business rule "only the authenticated operator can read tracked victims or manage the campaign" is not enforced server-side. Exploitation: 1) Attacker learns any one protected path (e.g. via Referer headers, the leaked injectCode value returned to victims, browser history, or the /login response if the key leaks). 2) Attacker directly POSTs to /get_data with an empty body — the server returns the full victim dataset (IDs, IPs, geolocation, user agents, captured form fields). 3) Attacker POSTs to /get_preview with vId=<any victim> to read that victim's networks, hosts alive, and preview data. No stats_key is ever required after the login page. |
|---|
| المصدر | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| المستخدم | GalaxynC (UID 98975) |
|---|
| ارسال | 18/07/2026 09:34 PM (2 أشهر منذ) |
|---|
| الاعتدال | 06/09/2026 08:24 PM (2 months later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 398784 [jofpin trape 1.0.0 Login Endpoint core/stats.py توثيق ضعيف] |
|---|
| النقاط | 0 |
|---|