| عنوان | tsi-coop tsi-dpdp-cms 0.5.0 Information Exposure via Pre-Authentication Parameter Validation |
|---|
| الوصف | TSI DPDP CMS performs JSON schema validation before verifying the caller's authentication token on multiple API endpoints.
When an unauthenticated attacker sends a POST request with a valid _func value but omits required fields, the server returns HTTP 400 and names every missing required field — all before checking whether an Authorization header is present or valid.
By iteratively supplying parameters one by one and observing the server's 400 error messages, an attacker can fully map the internal API parameter schema for every _func operation without any credentials.
Correct behavior: authenticate first → return HTTP 401 on missing/invalid token → never reach parameter validation.
Actual behavior: validate parameters → disclose field names in error → then (if fields are present) check auth. |
|---|
| المصدر | ⚠️ https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md |
|---|
| المستخدم | Kavin Kumar S T (UID 99814) |
|---|
| ارسال | 07/09/2026 09:35 PM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 12:08 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416587 [tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2 JSON Schema Validation _func الكشف عن المعلومات] |
|---|
| النقاط | 20 |
|---|