Description

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.5.1 is able to mitigate this issue. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T19:18:09.393Z",
  "pubdate": "2026-09-02T19:18:09.393Z",
  "executiveSummary": "A critical security vulnerability has been identified in tsi-coop tsi-dpdp-cms up to version 0.5.0, involving a failure to enforce authentication controls within the Bootstrap Setup Endpoint.\nThis vulnerability is classified as a missing authentication flaw, which allows remote, unauthenticated attackers to interact with sensitive system configuration interfaces.\nBy bypassing the required security handshake, an attacker can gain unauthorized access to the system setup process, potentially leading to full compromise of the application instance.\nThe vulnerability is currently exploitable via publicly available methods, posing a high risk to deployments that have not yet been upgraded.\nThe flaw affects the InterceptingFilter.java component, which serves as a critical gatekeeper for incoming requests; its failure to validate identity credentials leaves the administrative endpoint exposed to the public network.\nOrganizations using tsi-dpdp-cms are strongly advised to transition to version 0.5.1 to ensure that authentication mechanisms are properly initialized and enforced.",
  "technicalDetails": "The vulnerability originates within the InterceptingFilter.java file, a core component responsible for filtering HTTP requests before they reach the Bootstrap Setup Endpoint. In affected versions (up to 0.5.0), the filtering logic fails to verify the presence or validity of authentication tokens, effectively allowing requests to bypass security constraints entirely.\nThe root cause is a deficiency in the filter chain implementation where the Bootstrap Setup path is inadvertently excluded from, or fails to trigger, the necessary authentication interceptor logic. Because the application relies on this filter to guard access to initialization parameters, the flaw permits an unauthenticated remote actor to interact with endpoints that govern system bootstrap procedures.\nThe exploitation flow begins with the attacker identifying the target network address of the Bootstrap Setup Endpoint. Since the InterceptingFilter.java logic does not require a valid session or authentication header, the attacker can send crafted HTTP requests directly to the sensitive endpoint. The server processes these requests as legitimate because the filter fails to halt the request lifecycle during the pre-processing phase.\nBy successfully invoking the Bootstrap Setup functions without authentication, an attacker can manipulate system configurations, alter administrative settings, or trigger internal administrative workflows intended only for authorized personnel. This represents a significant security breakdown in the application's access control architecture.\nThe exploitability of this vulnerability is enhanced by the fact that it requires no prior privileges or network-internal positioning; it is fully remotely accessible, provided the endpoint is reachable. Once the initial unauthorized access is achieved, the attacker can potentially influence application state, leading to subsequent impact on data integrity and availability.\nThe absence of verification within the InterceptingFilter.java effectively renders the endpoint's inherent security protections null, making the implementation of a patch a mandatory requirement for system hardening. Version 0.5.1 addresses this issue by correcting the logic within the filter class to ensure that all requests destined for the Bootstrap Setup Endpoint are subject to strict identity verification before dispatching to the underlying business logic."
}