djust is a Django reactive server-side rendering tool with Rust-powered performance. Before version 1.0.7, its SSE client-to-server POST endpoints were marked @csrf_exempt, and the SSE GET stream endpoint did not validate the Origin header. This allowed a cross-origin attacker to induce a victim's browser, authenticated via cookies, to initiate SSE sessions and send POST requests with credentials included, triggering state-changing event handlers. The session_id parameter is client-chosen and only format-validated, not serving as a CSRF token. The POST requests used a text/plain content type, which is a CORS simple request and bypassed preflight checks. The fix in 1.0.7 adds Origin validation against ALLOWED_HOSTS for all SSE endpoints and requires POST requests to have Content-Type: application/json, blocking the previous bypass. Workarounds include disabling SSE transport or proxying with an Origin allowlist.

An attacker can exploit this vulnerability to perform unauthorized state-changing actions on behalf of an authenticated user by leveraging cross-origin requests. This can lead to compromise of user session integrity and unauthorized operations within the djust application context. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality and integrity, with no impact on availability.

This vulnerability is fixed in djust version 1.0.7. Users should upgrade to version 1.0.7 or later to ensure all SSE endpoints validate the Origin header and enforce Content-Type requirements on POST requests. As a temporary workaround, disabling the SSE transport or placing a proxy in front of the service that enforces an Origin allowlist can mitigate the risk.