Executive brief
djust is a web application framework that includes observability endpoints for monitoring live application state and invoking handlers. The default documented setup left these sensitive endpoints network-exposed because the localhost protection was optional middleware that the documentation did not mention, and the endpoints only checked the DEBUG setting. An attacker on the network could read live application state (including session data) and invoke remote methods without authentication. The issue is fixed in version 1.0.7 by making the localhost restriction mandatory and built into the endpoints themselves.
Technical details
The vulnerability is a missing authentication and improper access control issue (CWE-306, CWE-668) in djust's observability endpoints. The documented default configuration did not include a required middleware for localhost-only access; instead, the views enforced only DEBUG mode, which is typically enabled in development. This allowed any network-reachable client to access the observability endpoints without authentication. An unauthenticated attacker could read live view/session state and invoke the eval_handler remote method-invocation surface. The root cause is the separation of access control logic (middleware) from the views themselves, combined with omitting the middleware from documentation. Fixed in djust 1.0.7 by enforcing the localhost restriction in-view on every observability endpoint and restricting eval_handler; ungated requests now receive a non-disclosing response. Attack vector is network; no privileges or user interaction required, but exploitation requires DEBUG=True in the documented misconfigured scenario.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-09-16: advisory: Updated advisory with additional details
- 2026-06-22: patched: Fixed in djust 1.0.7