TSI DDPD CMS Client-Side Auth Bypass via Direct HTTP Request

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: TSI-DDPD-CMS-Client-Side-Only-Authentication-Allows-Complete-Bypass-via-Direct-HTTP-Request Vulnerability Type: Client-Side Only Authentication Bypass Root Cause: The authentication check in TSI DDPD CMS is executed entirely on the browser side (JavaScript); the server performs no authentication for console pages, directly returning HTTP 200. Core Mechanism: The JS in the pages reads and redirects to the login page if no token is found; however, any HTTP client (curl, wget, Python requests, etc.) does not execute JS, and therefore can directly retrieve the full page. Impact Scope Affected Pages: All 17 console pages (5 admin + 12 DPO) Exposed Content: - Full JS source code (~100KB of application logic) - Paths of 12 internal REST endpoints (e.g., , , , , etc.) - 50+ dispatch values (covering breach management, ROPA lifecycle, compliance auditing, etc.) - Authentication token format and storage scheme ( ) - Role-based routing logic, password recovery function names and parameters Conclusion: Since the server performs no authentication, all downstream information exposure stems from this architectural flaw. POC / Exploitation Code POC 1: Batch request all console pages (no credentials required) POC 2: Single-page verification Authentication check source code (client-side) Remediation 1. Enforce server-side authentication: Add an authentication middleware at the web server/gateway layer for routes; return 401/403 instead of 200 when a valid token is not presented. 2. Remove or harden the client-side check: Treat the JS redirect as a UX optimization only, not as a security boundary. 3. Authenticate API endpoints: Add server-side token validation ( ) to the 12 internal REST endpoints. 4. Minimize information disclosure: For unauthenticated requests, return a minimal response to avoid exposing the full JS source and API logic. 5. Regression testing: Verify using non-JS clients like curl that all console pages return 401/403 when unauthenticated.

Goal Reached Thanks to every supporter — we hit 100%!

TSI DDPD CMS Client-Side Auth Bypass via Direct HTTP Request

More from this source