GHSA-f795-p5jw-j6g2: High severity pip/djust vulnerability
Impact SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a sessionid could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state.
Patches Fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal.
Workarounds Disable the SSE transport short of upgrading.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Disable the SSE transport short of upgrading (per guidance: “Disable the SSE transport short of upgrading.”).
SSE transport SSE transport enablement = disabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using djust's SSE transport are exposed. The issue affects SSE sessions because their client-chosen session_id was not bound to the authenticated user.
What does an attacker need to exploit it?
An attacker needs to learn a victim's SSE session_id, such as when the victim leaks it. The attacker can then connect to the message endpoint and dispatch handlers under the victim's identity and state.
How can the issue be mitigated if upgrading is not immediately possible?
Disable the SSE transport. This removes the affected transport path until an upgrade can be performed.
What version fixes the vulnerability?
djust 1.0.7 fixes the issue by binding each SSE session to its owning principal and rejecting cross-principal access. It also caps SSE session creation per principal.