CyberRota Analysis
AI-GeneratedThe vulnerability affects the djust library used for reactive server-side rendering in Django, where prior to version 1.0.7, Server-Sent Events (SSE) sessions were improperly keyed by a client-chosen `session_id`, allowing attackers to hijack sessions and execute actions as the authenticated user. This poses a significant risk of unauthorized access and manipulation of user data. Organizations using djust versions before 1.0.7 should prioritize upgrading to the latest version or disabling the SSE transport to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a `session_id` could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. This is fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal. As a workaround, disable the SSE transport.