| 제목 | tsi-coop tsi-dpdp-cms 0.5.0 Information Exposure via Pre-Authentication Parameter Validation |
|---|
| 설명 | TSI DPDP CMS performs JSON schema validation before verifying the caller's authentication token on multiple API endpoints.
When an unauthenticated attacker sends a POST request with a valid _func value but omits required fields, the server returns HTTP 400 and names every missing required field — all before checking whether an Authorization header is present or valid.
By iteratively supplying parameters one by one and observing the server's 400 error messages, an attacker can fully map the internal API parameter schema for every _func operation without any credentials.
Correct behavior: authenticate first → return HTTP 401 on missing/invalid token → never reach parameter validation.
Actual behavior: validate parameters → disclose field names in error → then (if fields are present) check auth. |
|---|
| 원천 | ⚠️ https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md |
|---|
| 사용자 | Kavin Kumar S T (UID 99814) |
|---|
| 제출 | 2026. 09. 07. PM 09:35 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 12:08 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416587 [tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2 JSON Schema Validation _func 정보 공개] |
|---|
| 포인트들 | 20 |
|---|