| Titolo | jofpin trape latest (main/master branch) CWE-306 |
|---|
| Descrizione | Multiple victim-facing endpoints accept an arbitrary vId/id from the request body and update victim records without verifying that the caller actually owns that vId. The vId is generated client-side (or defaults to a 5-char token) and is never validated against any server-issued credential. This breaks the integrity business rule: each tracked session's data (IP, online status, last ping time, battery, GPU, navigation mode) should reflect the actual victim's state. An attacker can overwrite another victim's recorded data, mark them online/offline, or poison their geolocation. Exploitation: 1. Attacker POSTs to /cIp with id=victim_A_id&ip=192.168.99.99, corrupting victim A's recorded local IP. 2. Attacker POSTs to /tping with id=victim_B_id every few seconds, keeping a victim falsely 'online' forever and hiding their actual disconnect. 3. Attacker POSTs to /lr with vId=victim_C_id&lat=0&lon=0 to spoof geolocation. The vId tokens are only 5 characters from a limited charset, making enumeration feasible. |
|---|
| Fonte | ⚠️ https://github.com/jofpin/trape/issues/407 |
|---|
| Utente | GalaxynC (UID 98975) |
|---|
| Sottomissione | 18/07/2026 21:35 (2 mesi fa) |
|---|
| Moderazione | 06/09/2026 20:25 (2 months later) |
|---|
| Stato | Duplicato |
|---|
| Voce VulDB | 398786 [jofpin trape 2.0 core/user.py vId/id escalationi di privilegi] |
|---|
| Punti | 0 |
|---|