| 标题 | jofpin trape latest (main/master branch) CWE-613 |
|---|
| 描述 | The login endpoint validates trape.stats_key, but none of the protected admin endpoints (/get_data, /get_preview, /get_requests, /get_socialimpact, /<remove_path>, /pn) verify that the caller has authenticated. No session token, cookie, or server-side auth state is established or checked. Authentication is purely cosmetic — the only thing gating the admin APIs is path obfuscation, and the /login response itself leaks every protected path (home_path, remove_path, etc.) to whoever supplies the key. The business rule "only the authenticated operator can read tracked victims or manage the campaign" is not enforced server-side. Exploitation: 1) Attacker learns any one protected path (e.g. via Referer headers, the leaked injectCode value returned to victims, browser history, or the /login response if the key leaks). 2) Attacker directly POSTs to /get_data with an empty body — the server returns the full victim dataset (IDs, IPs, geolocation, user agents, captured form fields). 3) Attacker POSTs to /get_preview with vId=<any victim> to read that victim's networks, hosts alive, and preview data. No stats_key is ever required after the login page. |
|---|
| 来源 | ⚠️ https://github.com/jofpin/trape/issues/405 |
|---|
| 用户 | GalaxynC (UID 98975) |
|---|
| 提交 | 2026-07-18 21時34分 (2 月前) |
|---|
| 管理 | 2026-09-06 20時24分 (2 months later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 398784 [jofpin trape 1.0.0 Login Endpoint core/stats.py 弱身份验证] |
|---|
| 积分 | 0 |
|---|