Executive brief
djust is a web framework library that supports real-time communication between clients and servers using Server-Sent Events (SSE). A vulnerability in its SSE transport allows an attacker to forge requests from a victim's browser to trigger unauthorized state-changing actions in the victim's djust session. An attacker can accomplish this by embedding malicious content on a cross-origin website that, when visited by a victim with active authentication cookies, silently forces the victim's browser to establish a djust session and execute commands as the victim.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) in djust's Server-Sent-Events (SSE) transport layer. The root cause is the lack of origin validation on SSE endpoints combined with exemption from CSRF protection. An attacker can exploit this by: (1) hosting malicious HTML on an attacker-controlled domain that makes cross-origin requests to a victim's djust application; (2) leveraging the fact that SSE GET endpoints lack Origin checks and POST endpoints are @csrf_exempt; (3) sending JSON payloads as text/plain to bypass Content-Type restrictions and CORS preflight requirements. When a victim with valid authentication cookies visits the malicious site, their browser silently establishes an SSE session and POSTs commands to state-changing event handlers. The session_id is client-chosen and validated only for UUID format, offering no CSRF token protection. Fixed in version 1.0.7 by adding Origin validation against ALLOWED_HOSTS on all three SSE endpoints and requiring Content-Type: application/json on POST endpoints.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-09-16: disclosed: Advisory published to GitHub Advisory Database
- 2026-06-22: patched: Fix released in djust 1.0.7