| タイトル | jofpin trape latest (main/master branch) CWE-306 |
|---|
| 説明 | The SocketIO event handlers on the /trape namespace perform zero authentication. The 'join' handler allows any connected client to join any room (victim sessions are keyed by vId). The 'my_room_event' handler emits attacker-controlled data including type fields like 'redirect', 'execute', 'jscode', 'jsscript', 'alert', and 'talk' to any specified room. These message types correspond to attack actions on tracked victims (redirecting, downloading files, injecting scripts, sending voice messages). The broken business rule is that operator-only command channels to victims have no access control, allowing any network observer to hijack victim sessions or inject arbitrary commands. Exploitation: An attacker connects to the trape SocketIO endpoint at ws://target:port/socket.io (namespace /trape). They emit a 'join' event with a victim's room name (the vId, a short 5-character token visible in network traffic or guessable). They then emit 'my_room_event' with {room: victim_vId, data: {type: 'jsscript', message: 'malicious_payload'}} to inject arbitrary JavaScript into the victim's browser, or {type: 'redirect', message: 'http://evil.com'} to redirect the victim. They can also passively listen to all 'my_response' events to intercept data flowing between the operator and victims. |
|---|
| ソース | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| ユーザー | GalaxynC (UID 98975) |
|---|
| 送信 | 2026年07月18日 21:32 (3 月 ago) |
|---|
| モデレーション | 2026年09月06日 20:24 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room 弱い認証] |
|---|
| ポイント | 0 |
|---|