| 제목 | jofpin trape latest (main/master branch) CWE-306 |
|---|
| 설명 | The victim identifier (vId) is accepted directly from the client's POST form data without any ownership verification. The server generates a vId only when the client sends an empty string; otherwise it trusts whatever value the client supplies. Every subsequent victim-data endpoint (/lr, /lc, /bs, /nm, /regv, /tping, /cIp, /gGpu, /nr) also accepts vId from the request body and performs database updates keyed on that value with no proof that the requester is the original owner of that identifier. The business rule "a victim session can only write its own data" is not enforced anywhere. Additionally, since /get_data is unauthenticated, an attacker can enumerate all valid vIds first. Exploitation: 1. Attacker sends POST /get_data (no auth needed) and extracts the vId of a real tracked victim. 2. Attacker sends POST /lr with vId set to the victim's real ID, lat/lon set to arbitrary coordinates — the victim's stored geolocation is overwritten with attacker-chosen values. 3. Attacker sends POST /regv with the victim's vId and crafted site/fid/name/value to inject fake form-capture records into the victim's session, polluting the operator's collected intelligence. 4. Attacker sends POST /tping with any vId to keep victims permanently marked 'online' or to spoof liveness. |
|---|
| 원천 | ⚠️ https://github.com/jofpin/trape/issues/407 |
|---|
| 사용자 | GalaxynC (UID 98975) |
|---|
| 제출 | 2026. 07. 18. PM 09:37 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 06. PM 08:25 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 398786 [jofpin trape 2.0 core/user.py vId/id 권한 상승] |
|---|
| 포인트들 | 0 |
|---|