Djust
Monthly
Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cross-origin attacker page to drive a victim's cookie-authenticated SSE session, firing state-changing LiveView event handlers as that victim. Remote attackers need no authentication of their own, but exploitation requires the victim to be lured to an attacker-controlled page while holding an active authenticated djust session and while the SSE transport is enabled (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - integrity impact only, no confidentiality or availability impact). The flaw is fully fixed in 1.0.7 (Origin validated against ALLOWED_HOSTS with 403 for cross-origin requests, and POST endpoints now requiring Content-Type: application/json with 415 otherwise); no public exploit code was identified at time of analysis and the CVE has not been listed in CISA KEV.
Mass assignment in djust, a Django library providing Phoenix LiveView-style reactive server-side rendering, allows any client with an established WebSocket session to overwrite arbitrary public attributes on a LiveView instance through the framework's default `update_model` event handler. The handler ships in `djust.mixins.model_binding.ModelBindingMixin`, which sits in the LiveView base MRO and is therefore exposed by every view, and it `setattr`s a view attribute whose name is supplied entirely by the client - gated only by a 14-entry framework-internal denylist, an underscore-prefix rejection, and an opt-in `allowed_model_fields` allowlist that defaults to `None` (allow all). Affected deployments are djust versions prior to 1.0.7 that leave the allowlist unset and keep authorization, ownership, or business state such as `self.account_id`, `self.is_admin`, or `self.total_price` as public view attributes; the advisory's own reproducer set all three without any `dj-model` binding. Exploitation yields state tampering that can escalate to authorization-flag manipulation or IDOR when downstream handlers act on the tampered attributes without re-authorizing, giving a High integrity impact with no confidentiality or availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N); no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the vendor retained a private reproducer.
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cross-origin attacker page to drive a victim's cookie-authenticated SSE session, firing state-changing LiveView event handlers as that victim. Remote attackers need no authentication of their own, but exploitation requires the victim to be lured to an attacker-controlled page while holding an active authenticated djust session and while the SSE transport is enabled (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - integrity impact only, no confidentiality or availability impact). The flaw is fully fixed in 1.0.7 (Origin validated against ALLOWED_HOSTS with 403 for cross-origin requests, and POST endpoints now requiring Content-Type: application/json with 415 otherwise); no public exploit code was identified at time of analysis and the CVE has not been listed in CISA KEV.
Mass assignment in djust, a Django library providing Phoenix LiveView-style reactive server-side rendering, allows any client with an established WebSocket session to overwrite arbitrary public attributes on a LiveView instance through the framework's default `update_model` event handler. The handler ships in `djust.mixins.model_binding.ModelBindingMixin`, which sits in the LiveView base MRO and is therefore exposed by every view, and it `setattr`s a view attribute whose name is supplied entirely by the client - gated only by a 14-entry framework-internal denylist, an underscore-prefix rejection, and an opt-in `allowed_model_fields` allowlist that defaults to `None` (allow all). Affected deployments are djust versions prior to 1.0.7 that leave the allowlist unset and keep authorization, ownership, or business state such as `self.account_id`, `self.is_admin`, or `self.total_price` as public view attributes; the advisory's own reproducer set all three without any `dj-model` binding. Exploitation yields state tampering that can escalate to authorization-flag manipulation or IDOR when downstream handlers act on the tampered attributes without re-authorizing, giving a High integrity impact with no confidentiality or availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N); no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the vendor retained a private reproducer.
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.