Tsi Coop
Monthly
An unauthenticated information disclosure in tsi-coop tsi-dpdp-cms versions 0.5.2 and earlier lets a remote attacker map the internal API parameter schema by sending a valid `_func` value with required fields omitted; the server's JSON schema validator runs before authentication and replies with a 400 error naming every missing field (for example `required property 'fiduciary_id' not found`). The leak is confined to internal parameter/field metadata for the admin, DPO and client APIs (job, API-key, operator and ROPA functions) and does not expose stored data, tokens, or permit writes. Publicly available exploit code exists, and the vendor released a fixed version (v0.5.3) after early coordinated contact; this is a moderate, not critical, priority issue.
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. A public proof-of-concept demonstrating the bypass is available, and the vendor has released a patched version (v0.5.1) confirmed to address both issues.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. A public POC exploit exists on GitHub, and vendor-released patch v0.5.1 is available.
An unauthenticated information disclosure in tsi-coop tsi-dpdp-cms versions 0.5.2 and earlier lets a remote attacker map the internal API parameter schema by sending a valid `_func` value with required fields omitted; the server's JSON schema validator runs before authentication and replies with a 400 error naming every missing field (for example `required property 'fiduciary_id' not found`). The leak is confined to internal parameter/field metadata for the admin, DPO and client APIs (job, API-key, operator and ROPA functions) and does not expose stored data, tokens, or permit writes. Publicly available exploit code exists, and the vendor released a fixed version (v0.5.3) after early coordinated contact; this is a moderate, not critical, priority issue.
Missing server-side authentication in tsi-coop tsi-dpdp-cms ≤0.5.0 exposes all 17 admin and DPO console pages to unauthenticated HTTP clients: the application enforced access via a client-side JavaScript redirect only, so any HTTP request that ignores the redirect receives the full page source including internal API endpoints, function names, and request schemas. A second bundled vulnerability allows unauthenticated super-admin account creation via an unprotected first-run setup endpoint (/api/v1/bootstrap/setup), enabling complete platform takeover on fresh or reset deployments. A public proof-of-concept demonstrating the bypass is available, and the vendor has released a patched version (v0.5.1) confirmed to address both issues.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. A public POC exploit exists on GitHub, and vendor-released patch v0.5.1 is available.