CVE-2024-22513
MEDIUMdjangorestframework-simplejwt <5.3.1 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-22513. PoCs published by Dhrumil Mistry.
AI-analyzed exploit summary This is a technical writeup demonstrating an information disclosure vulnerability in djangorestframework-simplejwt <= 5.3.1, where JWT tokens remain valid for inactive users due to missing validation checks. The code shows how an inactive user can still generate and verify tokens, leading to potential BOLA/BFLA issues.
Description
djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.
Exploits (1)
This is a technical writeup demonstrating an information disclosure vulnerability in djangorestframework-simplejwt <= 5.3.1, where JWT tokens remain valid for inactive users due to missing validation checks. The code shows how an inactive user can still generate and verify tokens, leading to potential BOLA/BFLA issues.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N