Listen to this Post
DailyCVE Form:
Platform: Django djust
Version: < 1.0.7
Vulnerability: Auth Bypass
Severity: Critical
date: 2026-09-17
Prediction: Patched in 1.0.7
What Undercode Say
pip show djust
python -c “import djust; print(djust.__version__)”
grep -r “check_view_auth” /path/to/djust/
grep -r “as_view” /path/to/djust/admin/
django-admin check
python manage.py migrate
from django.contrib.auth.mixins import LoginRequiredMixin
from django.views.generic import TemplateView
class ProtectedView(LoginRequiredMixin, TemplateView):
template_name = “protected.html”
from djust import LiveView
class SecureLiveView(LiveView):
template_name = “secure.html”
login_required = True
from djust import LiveView
from djust.auth import check_view_auth
class AdminLiveView(LiveView):
template_name = “admin.html”
login_required = True
permission_required = “auth.view_user”
Exploit: (Educational Purposes!)
An unauthenticated attacker opens a WebSocket connection directly to a djust LiveView mount endpoint, bypassing the HTTP GET request that would normally trigger Django’s dispatch chain. Because `check_view_auth` does not honor `LoginRequiredMixin` or @method_decorator(login_required, name="dispatch"), the WebSocket mount succeeds without credentials. The attacker can then dispatch event handlers and manipulate view state—including admin list/create/change/delete operations—over the persistent WebSocket channel. Tools such as `websocat` or a custom `websockets` Python client can establish the connection and send crafted mount/event messages without prior authentication.
Protection: from this CVE
Upgrade djust to version 1.0.7 or later immediately. Version 1.0.7 enforces authorization consistently across HTTP and WebSocket/SSE transports: `check_view_auth` now honors the Django `AccessMixin` family, system check S004 fails loudly at startup on un-replayable auth patterns, and the admin base mixin declares `login_required = True` with an active-staff `check_permissions` gate. If immediate patching is not possible, audit every LiveView and replace HTTP-only mixins and decorators with djust’s transport-agnostic attributes (login_required, permission_required, check_permissions), which are honored on all transports.
Impact
Confidentiality and integrity are both rated High. An anonymous or under-privileged client can mount restricted views—including djust admin list/create/change/delete—and dispatch their handlers, leading to unauthorized data access, data modification, and privilege escalation within the application’s administrative layer. Availability is not impacted (A:N). CVSS v3.1 base score: 9.1 (Critical).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
