| タイトル | jofpin trape latest (main/master branch) CWE-306 |
|---|
| 説明 | The application's admin data endpoints expose all tracked victim data (IP addresses, geolocation coordinates, browser fingerprints, captured form inputs, network information) without any session or authentication check. Every admin API endpoint (/get_data, /get_preview, /get_requests, /get_socialimpact) trusts the caller implicitly. The business rule that only the operator who knows the secret stats_key should view tracked data is completely broken. Exploitation: An attacker who can reach the trape server (e.g., via the ngrok public URL) sends: POST /get_data with an empty body. The server returns the full victim dataset including IPs, GPS coordinates, ISPs, and browser details. POST /get_requests returns all captured form field values. POST /get_preview with vId=<any victim ID> returns that specific victim's detailed profile. No knowledge of stats_key is required. |
|---|
| ソース | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| ユーザー | GalaxynX (UID 98977) |
|---|
| 送信 | 2026年07月18日 21:26 (2 月 ago) |
|---|
| モデレーション | 2026年09月04日 14:19 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room 弱い認証] |
|---|
| ポイント | 20 |
|---|