| शीर्षक | jofpin trape latest (main/master branch) CWE-306 |
|---|
| विवरण | The SocketIO event handlers on the /trape namespace perform zero authentication. The 'join' handler allows any connected client to join any room (victim sessions are keyed by vId). The 'my_room_event' handler emits attacker-controlled data including type fields like 'redirect', 'execute', 'jscode', 'jsscript', 'alert', and 'talk' to any specified room. These message types correspond to attack actions on tracked victims (redirecting, downloading files, injecting scripts, sending voice messages). The broken business rule is that operator-only command channels to victims have no access control, allowing any network observer to hijack victim sessions or inject arbitrary commands. Exploitation: An attacker connects to the trape SocketIO endpoint at ws://target:port/socket.io (namespace /trape). They emit a 'join' event with a victim's room name (the vId, a short 5-character token visible in network traffic or guessable). They then emit 'my_room_event' with {room: victim_vId, data: {type: 'jsscript', message: 'malicious_payload'}} to inject arbitrary JavaScript into the victim's browser, or {type: 'redirect', message: 'http://evil.com'} to redirect the victim. They can also passively listen to all 'my_response' events to intercept data flowing between the operator and victims. |
|---|
| स्रोत | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| उपयोगकर्ता | GalaxynC (UID 98975) |
|---|
| सबमिशन | 18/07/2026 09:32 PM (2 महीनों पहले) |
|---|
| संयम | 06/09/2026 08:24 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|