CyberRota Analysis
AI-GeneratedLemur versions prior to 1.9.3 are vulnerable to an issue where an authority-role member can update the ACME URL without proper revalidation, potentially redirecting requests to an attacker-controlled server. This vulnerability allows unauthorized access to sensitive internal services and cloud metadata endpoints through JWS-signed requests. Organizations using Lemur for TLS certificate management, particularly those with authority-role members, should prioritize upgrading to version 1.9.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and direct setup_acme_client_no_retry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder, authorizations, and finalize URLs chosen by that server. The Lemur ClientV2 followed those URLs without requiring their host to match the configured directory host, allowing JWS-signed requests to internal services or cloud metadata endpoints. The issue required an ACME authority and a user authorized for that authority, but did not require global administrator privileges. The fix revalidates updates and introduces _PinnedClientNetwork to enforce a single allowed host for the complete ACME flow. This issue is fixed in version 1.9.3.