| Titre | TSI Coop TSI DPDP CMS 0.4.8 Missing Authentication |
|---|
| Description | TSI DPDP CMS exposes its Super Administrator bootstrap endpoint (POST /api/v1/bootstrap/setup) and the associated setup wizard (/console/setup/init.html) without requiring authentication. On a fresh deployment—or after the application's database has been reset—an unauthenticated attacker can create a new Super Administrator account by sending a single POST request to the bootstrap endpoint, resulting in full administrative control of the application.
The endpoint accepts a JSON request containing _func: "initial_setup" along with the administrator's email, name, and password. The server processes this request without verifying the identity of the requester, allowing anyone to initialize the application and create the first privileged account.
The only protection implemented is a server-side state check that prevents the setup process from running after the application has already been initialized. In that case, the server responds with HTTP 500 and the message, "System is already configured." However, this is a deployment-state check rather than an authentication mechanism. It offers no protection on new installations, redeployments, or any scenario where the application's database has been reset or otherwise returned to an uninitialized state.
Additionally, the setup wizard page (/console/setup/init.html) remains publicly accessible even after initialization. Although the backend prevents the setup from completing once the system is configured, the page continues to present a fully functional initialization interface to any unauthenticated user, unnecessarily exposing the application's bootstrap functionality and increasing the attack surface. |
|---|
| La source | ⚠️ https://github.com/mano257200/TSI-DPDP-CMS-Unauthenticated-Super-Admin-Bootstrap-Endpoint/blob/main/README.md |
|---|
| Utilisateur | Mahendravarman (UID 80955) |
|---|
| Soumission | 10/07/2026 19:34 (il y a 2 mois) |
|---|
| Modérer | 02/09/2026 13:57 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 398082 [tsi-coop tsi-dpdp-cms jusqu’à 0.5.0 Bootstrap Setup Endpoint InterceptingFilter.java authentification faible] |
|---|
| Points | 20 |
|---|