| Título | jofpin trape latest (main/master branch) CWE-306 |
|---|
| Descripción | The application's admin data endpoints expose all tracked victim data (IP addresses, geolocation coordinates, browser fingerprints, captured form inputs, network information) without any session or authentication check. Every admin API endpoint (/get_data, /get_preview, /get_requests, /get_socialimpact) trusts the caller implicitly. The business rule that only the operator who knows the secret stats_key should view tracked data is completely broken. Exploitation: An attacker who can reach the trape server (e.g., via the ngrok public URL) sends: POST /get_data with an empty body. The server returns the full victim dataset including IPs, GPS coordinates, ISPs, and browser details. POST /get_requests returns all captured form field values. POST /get_preview with vId=<any victim ID> returns that specific victim's detailed profile. No knowledge of stats_key is required. |
|---|
| Fuente | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| Usuario | GalaxynX (UID 98977) |
|---|
| Sumisión | 2026-07-18 21:26 (hace 2 meses) |
|---|
| Moderación | 2026-09-04 14:19 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room autenticación débil] |
|---|
| Puntos | 20 |
|---|