| タイトル | jofpin trape latest (main/master branch) CWE-613 |
|---|
| 説明 | The login endpoint validates trape.stats_key, but none of the protected admin endpoints (/get_data, /get_preview, /get_requests, /get_socialimpact, /<remove_path>, /pn) verify that the caller has authenticated. No session token, cookie, or server-side auth state is established or checked. Authentication is purely cosmetic — the only thing gating the admin APIs is path obfuscation, and the /login response itself leaks every protected path (home_path, remove_path, etc.) to whoever supplies the key. The business rule "only the authenticated operator can read tracked victims or manage the campaign" is not enforced server-side. Exploitation: 1) Attacker learns any one protected path (e.g. via Referer headers, the leaked injectCode value returned to victims, browser history, or the /login response if the key leaks). 2) Attacker directly POSTs to /get_data with an empty body — the server returns the full victim dataset (IDs, IPs, geolocation, user agents, captured form fields). 3) Attacker POSTs to /get_preview with vId=<any victim> to read that victim's networks, hosts alive, and preview data. No stats_key is ever required after the login page. |
|---|
| ソース | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| ユーザー | GalaxynC (UID 98975) |
|---|
| 送信 | 2026年07月18日 21:34 (2 月 ago) |
|---|
| モデレーション | 2026年09月06日 20:24 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 398784 [jofpin trape 1.0.0 Login Endpoint core/stats.py 弱い認証] |
|---|
| ポイント | 0 |
|---|