GHSA-8g2f-g3gq-5rjv: High severity pip/djust vulnerability
Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface (evalhandler). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely.
Patches Fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and evalhandler is restricted; gated requests receive a non-disclosing response.
Workarounds Ensure DEBUG=False in production, and do not expose the observability endpoints to untrusted networks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Ensure DEBUG=False in production to prevent the misconfigured-but-documented scenario from exposing live view/session state and remote handler invocation.
djust (production deployment) DEBUG = False - Configuration
Do not expose the observability endpoints to untrusted networks; access should be limited so only localhost requests can reach the endpoints (localhost restriction is enforced in-view in djust 1.0.7).
djust observability endpoints network exposure = restricted - Compensating control
If any requests are possible from non-localhost clients, ensure eval_handler is not accessible to them; in djust 1.0.7, gated requests receive a non-disclosing response and eval_handler is restricted.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments with DEBUG enabled that expose djust observability endpoints to non-localhost or otherwise untrusted networks are exposed when the localhost-restriction middleware was not installed. The documented setup omitted that opt-in middleware.
What can a remote attacker do?
A non-localhost client can read live view and session state and invoke handlers through the eval_handler remote method-invocation surface. Exploitation does not require privileges or user interaction, but the attack complexity is rated high.
What version fixes the issue?
djust 1.0.7 fixes the issue. It enforces localhost restrictions within every observability view and restricts eval_handler.
What should be done if upgrading is not immediately possible?
Set DEBUG=False in production and ensure observability endpoints are not exposed to untrusted networks. This prevents the DEBUG-gated views from being accessible in the affected scenario.