| Title | jofpin trape latest (main/master branch) CWE-613 |
|---|
| Description | The login endpoint validates trape.stats_key, but none of the protected admin endpoints (/get_data, /get_preview, /get_requests, /get_socialimpact, /<remove_path>, /pn) verify that the caller has authenticated. No session token, cookie, or server-side auth state is established or checked. Authentication is purely cosmetic — the only thing gating the admin APIs is path obfuscation, and the /login response itself leaks every protected path (home_path, remove_path, etc.) to whoever supplies the key. The business rule "only the authenticated operator can read tracked victims or manage the campaign" is not enforced server-side. Exploitation: 1) Attacker learns any one protected path (e.g. via Referer headers, the leaked injectCode value returned to victims, browser history, or the /login response if the key leaks). 2) Attacker directly POSTs to /get_data with an empty body — the server returns the full victim dataset (IDs, IPs, geolocation, user agents, captured form fields). 3) Attacker POSTs to /get_preview with vId=<any victim> to read that victim's networks, hosts alive, and preview data. No stats_key is ever required after the login page. |
|---|
| Source | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| User | GalaxynC (UID 98975) |
|---|
| Submission | 07/18/2026 21:34 (2 months ago) |
|---|
| Moderation | 09/06/2026 20:24 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 398784 [jofpin trape 1.0.0 Login Endpoint core/stats.py missing authentication] |
|---|
| Points | 0 |
|---|