| शीर्षक | jofpin trape latest (main/master branch) CWE-306 |
|---|
| विवरण | The Socket.IO /trape namespace accepts join requests for any room (keyed by vId) without verifying the connecting client is the operator or the victim associated with that room. The my_room_event handler also allows any connected client to broadcast arbitrary messages (redirect, alert, file download, script injection) to any victim's room. The business rule that only the authenticated operator can send attack commands to victims, and that victim telemetry is isolated per session, is completely broken. Exploitation: 1. Attacker connects to the public Socket.IO endpoint at /trape, emits {"join": {"room": "any_vId"}} and receives all real-time telemetry for that victim. 2. Attacker emits my_room_event with room=victim_id and data.type='jscode' to inject arbitrary JavaScript into the victim's browser without operator authorization. This effectively hijacks the operator's phishing infrastructure. |
|---|
| स्रोत | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| उपयोगकर्ता | GalaxynC (UID 98975) |
|---|
| सबमिशन | 18/07/2026 09:37 PM (2 महीनों पहले) |
|---|
| संयम | 06/09/2026 08:25 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room कमजोर प्रमाणीकरण] |
|---|
| अंक | 0 |
|---|