Information Disclosure Vulnerability in djangorestframework-simplejwt Package
Summary
UBUNTU-CVE-2024-22513: djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. Affects python-djangorestframework-simplejwt versions 5.0.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The djangorestframework-simplejwt package is a widely used library for implementing JSON Web Token (JWT) authentication in Django applications. It provides a simple and secure way to handle user authentication and authorization. However, versions 5.3.1 and earlier are susceptible to a critical vulnerability that allows unauthorized access to resources even after user accounts have been disabled.
Vulnerability Detail
The vulnerability arises from insufficient user validation checks in the for_user method of the djangorestframework-simplejwt package. This flaw allows users to access web application resources despite their accounts being disabled, leading to potential information disclosure. Attackers could exploit this vulnerability to gain unauthorized access to sensitive information, posing a significant risk to application security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement additional user validation checks in their application logic to prevent access to resources for disabled accounts until the package is updated. This may involve checking the user's active status before allowing access to sensitive endpoints.
Conclusion
The djangorestframework-simplejwt package has a critical vulnerability that allows unauthorized access to resources for disabled accounts. It is crucial for users to update to the latest patched version to safeguard their applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for python-djangorestframework-simplejwt →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a medium severity level.
Versions 5.3.1 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive information, posing a significant risk to user data and application integrity.
Yes, implementing additional user validation checks in your application can help mitigate the risk until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-djangorestframework-simplejwt.
