| शीर्षक | jofpin trape latest (main/master branch) CWE-613 |
|---|
| विवरण | The login endpoint validates the operator key (trape.stats_key) and returns configuration paths, but it never creates a server-side session, sets a session cookie, or issues an authentication token. Every sensitive data endpoint (/get_data, /get_preview, /get_requests, /get_socialimpact, /pn, and the dynamically generated remove path) performs zero credential verification. The authentication check exists only at /login as a one-time gate that has no effect on subsequent requests. The control-panel entry path (trape.stats_path) is hardcoded to the string 'ngrok', making the login page trivially discoverable. Exploitation: Attacker sends POST /get_data with an empty body - no credentials required. The server returns the full dataset of all tracked victims including IPs, geolocation, browser fingerprints, and captured form data. Attacker can rename victims via /pn, or delete victim records via the remove path. No step requires knowledge of stats_key. |
|---|
| स्रोत | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| उपयोगकर्ता | GalaxynX (UID 98977) |
|---|
| सबमिशन | 18/07/2026 09:28 PM (2 महीनों पहले) |
|---|
| संयम | 04/09/2026 02:19 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 398787 [jofpin trape 2.0 Telemetry Endpoint core/user.py vId रेस कंडीशन] |
|---|
| अंक | 20 |
|---|