| Title | jofpin trape latest (main/master branch) CWE-306 |
|---|
| Description | The Socket.IO /trape namespace accepts join requests for any room (keyed by vId) without verifying the connecting client is the operator or the victim associated with that room. The my_room_event handler also allows any connected client to broadcast arbitrary messages (redirect, alert, file download, script injection) to any victim's room. The business rule that only the authenticated operator can send attack commands to victims, and that victim telemetry is isolated per session, is completely broken. Exploitation: 1. Attacker connects to the public Socket.IO endpoint at /trape, emits {"join": {"room": "any_vId"}} and receives all real-time telemetry for that victim. 2. Attacker emits my_room_event with room=victim_id and data.type='jscode' to inject arbitrary JavaScript into the victim's browser without operator authorization. This effectively hijacks the operator's phishing infrastructure. |
|---|
| Source | ⚠️ https://github.com/jofpin/trape/issues/406 |
|---|
| User | GalaxynC (UID 98975) |
|---|
| Submission | 07/18/2026 21:37 (2 months ago) |
|---|
| Moderation | 09/06/2026 20:25 (2 months later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 398785 [jofpin trape 1.0.0/2.0 Admin Endpoint core/sockets.py join_room missing authentication] |
|---|
| Points | 0 |
|---|