CVE-2026-61593: Cross-Site Request Forgery in djust Server-Sent Events Transport Layer

The djust library provides real-time reactive UI rendering in Django applications by maintaining a continuous state synchronization channel. This channel is split into two main endpoints: a Server-Sent Events (SSE) GET stream for downstream updates and a series of POST endpoints for client-to-server action messages.

Because standard web browsers automatically send authentication cookies along with credentialed cross-origin GET requests, the lack of origin validation on the SSE stream endpoint allowed malicious web pages to initiate sessions on behalf of authenticated users.

At the same time, the POST message endpoints were decorated with @csrf_exempt to simplify JSON transmission. This combined structure meant that once a session was established, an attacker could dispatch cross-origin requests to trigger server-side handlers without triggering Django's built-in CSRF defenses.

The underlying vulnerability results from three distinct architecture design flaws. First, the GET endpoint used to establish the SSE stream did not perform any validation on the HTTP Origin header, allowing any external origin to request connection initialization with credentials.

Second, the framework relied on client-generated UUIDs as the reactive session identifiers rather than server-issued, cryptographically secure tokens. The server validated the session ID format via regular expression matching but did not verify whether the session ID was created by an authorized handshake.

Third, the client-to-server POST endpoints accepted request bodies with a Content-Type header set to text/plain. Browser security policies allow cross-origin POST requests with simple content types like text/plain to bypass CORS preflight checks, meaning the browser sent the payload and the session cookies directly to the target server.

The vulnerable routing and view logic did not inspect incoming headers before instantiating or finding the active LiveView session.

# Vulnerable Implementation (< 1.0.7)
from django.views.decorators.csrf import csrf_exempt
from django.http import HttpResponse, JsonResponse
import json
 
@csrf_exempt
def sse_message(request, session_id):
    # VULNERABILITY 1: Bypasses CSRF checks entirely
    # VULNERABILITY 2: Does not validate request.headers.get('Origin')
    # VULNERABILITY 3: Does not enforce application/json Content-Type
    payload = json.loads(request.body)
    trigger_event(session_id, payload)
    return JsonResponse({"status": "success"})

The patched version introduces strict origin validation against the configured django.conf.settings.ALLOWED_HOSTS and mandates the application/json content type.

# Patched Implementation (>= 1.0.7)
from django.views.decorators.csrf import csrf_exempt
from django.http import HttpResponseForbidden, HttpResponse
from django.conf import settings
from urllib.parse import urlparse
 
@csrf_exempt
def sse_message_patched(request, session_id):
    origin = request.headers.get('Origin')
    if origin:
        parsed_origin = urlparse(origin).netloc
        # Fix 1: Validate that the origin matches allowed hosts
        if parsed_origin not in settings.ALLOWED_HOSTS:
            return HttpResponseForbidden("Invalid Origin")
            
    # Fix 2: Require strict content-type to trigger CORS preflight
    content_type = request.content_type
    if content_type != 'application/json':
        return HttpResponse("Unsupported Media Type", status=415)
        
    payload = json.loads(request.body)
    trigger_event(session_id, payload)
    return JsonResponse({"status": "success"})

An attacker can exploit this vulnerability by hosting a malicious page and enticing an authenticated user of the vulnerable application to visit it. The attack requires no special privileges beyond web network access.

First, the malicious page runs JavaScript that opens a credentialed GET request to the djust SSE stream path, providing a random but valid UUID. The server parses the victim's session cookies, authenticates the request, and initializes a LiveView state linked to that UUID.

Second, the attacker sends a POST request containing the event handler execution payload to the message endpoint. The request is sent with the Content-Type header set to text/plain to bypass the browser's CORS preflight rules, while still delivering JSON content which the server processes without CSRF validation.

The direct impact is complete control over the victim's application session. An attacker can trigger any state-changing action that the active Django user is authorized to perform, including account modifications, data entry, and sensitive administrative tasks.

Because the SSE endpoint can also leak state updates back to the client-side channel under specific conditions, the confidentiality of user-specific state data is compromised. The CVSS score of 8.1 reflects high integrity and confidentiality impacts combined with low attack complexity and no requirement for prior privileges.

The primary remediation path is upgrading the djust package to version 1.0.7 or later, which implements strict Origin header matching and Content-Type enforcement.

If upgrading is not immediately possible, deploy a reverse proxy or Web Application Firewall (WAF) in front of the application. The proxy must be configured to inspect all incoming requests destined for the djust SSE paths and block any request where the Origin header does not match the application's domain, or where a POST request has a Content-Type other than application/json.