| タイトル | jofpin trape latest (main/master branch) CWE-306 |
|---|
| 説明 | The victim identifier (vId) is accepted directly from the client's POST form data without any ownership verification. The server generates a vId only when the client sends an empty string; otherwise it trusts whatever value the client supplies. Every subsequent victim-data endpoint (/lr, /lc, /bs, /nm, /regv, /tping, /cIp, /gGpu, /nr) also accepts vId from the request body and performs database updates keyed on that value with no proof that the requester is the original owner of that identifier. The business rule "a victim session can only write its own data" is not enforced anywhere. Additionally, since /get_data is unauthenticated, an attacker can enumerate all valid vIds first. Exploitation: 1. Attacker sends POST /get_data (no auth needed) and extracts the vId of a real tracked victim. 2. Attacker sends POST /lr with vId set to the victim's real ID, lat/lon set to arbitrary coordinates — the victim's stored geolocation is overwritten with attacker-chosen values. 3. Attacker sends POST /regv with the victim's vId and crafted site/fid/name/value to inject fake form-capture records into the victim's session, polluting the operator's collected intelligence. 4. Attacker sends POST /tping with any vId to keep victims permanently marked 'online' or to spoof liveness. |
|---|
| ソース | ⚠️ https://github.com/jofpin/trape/issues/407 |
|---|
| ユーザー | GalaxynC (UID 98975) |
|---|
| 送信 | 2026年07月18日 21:37 (2 月 ago) |
|---|
| モデレーション | 2026年09月06日 20:25 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 398786 [jofpin trape 2.0 core/user.py vId/id 特権昇格] |
|---|
| ポイント | 0 |
|---|