Executive brief
djust is a web framework for building interactive views. Applications that enable state snapshots are vulnerable to state tampering: an attacker can edit unsigned snapshot data in the page to inject false authorization claims (like admin privileges) or business-logic attributes (like account balances). An authenticated user with low privileges can escalate to higher privileges or modify sensitive application state. The fix signs state snapshots and rejects unsigned or forged ones.
Technical details
The vulnerability is an insufficient verification of data authenticity (CWE-345) and improper control of object attribute modification (CWE-915). When state snapshots are enabled, djust embeds a state_json snapshot in the client page. On reconnect, this snapshot is restored as trusted view state without integrity verification. An attacker with low privileges can craft a reconnect frame containing modified state_json to inject arbitrary view attributes (e.g., flipping is_admin to True or changing account_id). The attack requires the attacker to be authenticated (network-accessible, low-privilege account required) but requires no user interaction. The vulnerability impacts confidentiality and integrity of authorization and business state. Fixed in djust 1.0.7 by adding cryptographic signing to state snapshots; unsigned or forged snapshots are now rejected on the back-navigation restore path.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed: Advisory published by johnrtipton
- 2026-06-22: patched: Fixed in djust 1.0.7
- 2026-09-16: advisory: GitHub Advisory Database updated