GHSA-c67v-vqrp-m5wj: High severity pip/djust vulnerability
Impact For views that opt into state snapshots, the snapshot statejson embedded in the client page was restored on reconnect as trusted view state with no integrity check. A client could edit the unsigned statejson in their page and return it in the reconnect mount frame to inject arbitrary view attributes — e.g. flip isadmin to True, or change accountid / balance — escalating privilege or tampering with business state held in public view attributes (the normal djust pattern).
Patches Fixed in djust 1.0.7. State snapshots are signed; unsigned or forged snapshots are rejected on the back-navigation restore path.
Workarounds Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Do not enable state snapshots; do not hold authorization/ownership state in public view attributes.
djust views state_snapshots = disabled - Compensating control
If any views use state snapshots, ensure the snapshot state_json embedded in client pages is signed; rely on the back-navigation restore path that rejects unsigned or forged snapshots.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed if their views opt into state snapshots and place authorization, ownership, or other security-sensitive business state in public view attributes. Examples include attributes such as is_admin, account_id, or balance.
What must an attacker do to exploit it?
An attacker needs to modify the unsigned state_json embedded in their client page and send it back in a reconnect mount frame. The application then restores the altered data as trusted view state, allowing arbitrary public view attributes to be injected.
Is there a mitigation if updating is not immediately possible?
Do not enable state snapshots. Also avoid storing authorization or ownership state in public view attributes.
How does the fixed version prevent the attack?
djust 1.0.7 signs state snapshots and rejects unsigned or forged snapshots on the back-navigation restore path.