| タイトル | jofpin trape latest (main/master branch) CWE-306 |
|---|
| 説明 | The Socket.IO /trape namespace accepts join requests for any room (keyed by vId) without verifying the connecting client is the operator or the victim associated with that room. The my_room_event handler also allows any connected client to broadcast arbitrary messages (redirect, alert, file download, script injection) to any victim's room. The business rule that only the authenticated operator can send attack commands to victims, and that victim telemetry is isolated per session, is completely broken. Exploitation: 1. Attacker connects to the public Socket.IO endpoint at /trape, emits {"join": {"room": "any_vId"}} and receives all real-time telemetry for that victim. 2. Attacker emits my_room_event with room=victim_id and data.type='jscode' to inject arbitrary JavaScript into the victim's browser without operator authorization. This effectively hijacks the operator's phishing infrastructure. |
|---|
| ソース | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| ユーザー | GalaxynC (UID 98975) |
|---|
| 送信 | 2026年07月18日 21:37 (2 月 ago) |
|---|
| モデレーション | 2026年09月06日 20:25 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room 弱い認証] |
|---|
| ポイント | 0 |
|---|