| タイトル | tsi-coop tsi-dpdp-cms 0.5.0 Information Exposure via Pre-Authentication Parameter Validation |
|---|
| 説明 | TSI DPDP CMS performs JSON schema validation before verifying the caller's authentication token on multiple API endpoints.
When an unauthenticated attacker sends a POST request with a valid _func value but omits required fields, the server returns HTTP 400 and names every missing required field — all before checking whether an Authorization header is present or valid.
By iteratively supplying parameters one by one and observing the server's 400 error messages, an attacker can fully map the internal API parameter schema for every _func operation without any credentials.
Correct behavior: authenticate first → return HTTP 401 on missing/invalid token → never reach parameter validation.
Actual behavior: validate parameters → disclose field names in error → then (if fields are present) check auth. |
|---|
| ソース | ⚠️ https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md |
|---|
| ユーザー | Kavin Kumar S T (UID 99814) |
|---|
| 送信 | 2026年09月07日 21:35 (1 月 ago) |
|---|
| モデレーション | 2026年10月11日 12:08 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416587 [tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2 JSON Schema Validation _func 情報漏えい] |
|---|
| ポイント | 20 |
|---|