| Title | tsi-coop tsi-dpdp-cms 0.5.0 Information Exposure via Pre-Authentication Parameter Validation |
|---|
| Description | TSI DPDP CMS performs JSON schema validation before verifying the caller's authentication token on multiple API endpoints.
When an unauthenticated attacker sends a POST request with a valid _func value but omits required fields, the server returns HTTP 400 and names every missing required field — all before checking whether an Authorization header is present or valid.
By iteratively supplying parameters one by one and observing the server's 400 error messages, an attacker can fully map the internal API parameter schema for every _func operation without any credentials.
Correct behavior: authenticate first → return HTTP 401 on missing/invalid token → never reach parameter validation.
Actual behavior: validate parameters → disclose field names in error → then (if fields are present) check auth. |
|---|
| Source | ⚠️ https://github.com/kavinkumarst/TSI-DPDP-CMS-API-Parameter-Schema-Enumerable-Without-Authentication/blob/main/README.md |
|---|
| User | Kavin Kumar S T (UID 99814) |
|---|
| Submission | 09/07/2026 21:35 (1 month ago) |
|---|
| Moderation | 10/11/2026 12:08 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416587 [tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2 JSON Schema Validation _func information disclosure] |
|---|
| Points | 20 |
|---|