| タイトル | jofpin trape latest (main/master branch) CWE-306 |
|---|
| 説明 | Multiple victim-facing endpoints accept an arbitrary vId/id from the request body and update victim records without verifying that the caller actually owns that vId. The vId is generated client-side (or defaults to a 5-char token) and is never validated against any server-issued credential. This breaks the integrity business rule: each tracked session's data (IP, online status, last ping time, battery, GPU, navigation mode) should reflect the actual victim's state. An attacker can overwrite another victim's recorded data, mark them online/offline, or poison their geolocation. Exploitation: 1. Attacker POSTs to /cIp with id=victim_A_id&ip=192.168.99.99, corrupting victim A's recorded local IP. 2. Attacker POSTs to /tping with id=victim_B_id every few seconds, keeping a victim falsely 'online' forever and hiding their actual disconnect. 3. Attacker POSTs to /lr with vId=victim_C_id&lat=0&lon=0 to spoof geolocation. The vId tokens are only 5 characters from a limited charset, making enumeration feasible. |
|---|
| ソース | ⚠️ https://github.com/jofpin/trape/issues/407 |
|---|
| ユーザー | GalaxynC (UID 98975) |
|---|
| 送信 | 2026年07月18日 21:35 (2 月 ago) |
|---|
| モデレーション | 2026年09月06日 20:25 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 398786 [jofpin trape 2.0 core/user.py vId/id 特権昇格] |
|---|
| ポイント | 0 |
|---|