| عنوان | jofpin trape latest (main/master branch) CWE-306 |
|---|
| الوصف | The Socket.IO /trape namespace accepts join requests for any room (keyed by vId) without verifying the connecting client is the operator or the victim associated with that room. The my_room_event handler also allows any connected client to broadcast arbitrary messages (redirect, alert, file download, script injection) to any victim's room. The business rule that only the authenticated operator can send attack commands to victims, and that victim telemetry is isolated per session, is completely broken. Exploitation: 1. Attacker connects to the public Socket.IO endpoint at /trape, emits {"join": {"room": "any_vId"}} and receives all real-time telemetry for that victim. 2. Attacker emits my_room_event with room=victim_id and data.type='jscode' to inject arbitrary JavaScript into the victim's browser without operator authorization. This effectively hijacks the operator's phishing infrastructure. |
|---|
| المصدر | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| المستخدم | GalaxynC (UID 98975) |
|---|
| ارسال | 18/07/2026 09:37 PM (2 أشهر منذ) |
|---|
| الاعتدال | 06/09/2026 08:25 PM (2 months later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room توثيق ضعيف] |
|---|
| النقاط | 0 |
|---|