GHSA-pxmc-2ffp-8j67: High severity pip/lemur vulnerability
Summary
Repo under test: https://github.com/Netflix/lemur
PUT /api/1/certificates/<id>/revoke authorizes the caller against the Lemur database row (creator == current user, or CertificatePermission over the row's roles) rather than the underlying CA-side certificate identity. Separately, POST /api/1/certificates/upload lets any user passing StrictRolePermission create a new Certificate row while freely supplying body, authority (resolved by id/name with no AuthorityPermission check) and externalid; there is no uniqueness constraint on body, serial, or externalid.
An attacker can therefore read a target certificate's public body, authority.id, and externalid via GET /certificates/<id>, upload a duplicate row, and revoke that duplicate. The creator-bypass skips CertificatePermission, the empty-endpoints check passes because the duplicate has none, and service.revoke() then revokes at the CA using the attacker-supplied body (ACME) or externalid (DigiCert/Entrust/Google CA/CFSSL) under the authority's stored CA credentials — revoking the real production certificate.
Affected route
POST /api/1/certificates/upload → PUT /api/1/certificates/<dupid>/revoke
Affected code
- lemur/certificates/views.py:651 — only StrictRolePermission().can() gates upload; no AuthorityPermission check - lemur/certificates/schemas.py:391 — CertificateUploadInputSchema accepts caller-supplied authority and externalid - lemur/schemas.py:107 — AssociatedAuthoritySchema resolves any authority by id/name with no permission check - lemur/certificates/service.py:489 — upload() binds the caller-supplied authority onto the new row - lemur/certificates/models.py:119 — only name is unique; body/serial/externalid are not, and getorincreasename() auto-suffixes on collision - lemur/certificates/views.py:1677 — if g.currentuser != cert.user: ... CertificatePermission ... — creator of the duplicate row bypasses the owner check - lemur/certificates/views.py:1687 — if cert.endpoints: ... — duplicate row has no endpoints, so the deployed-cert safeguard is bypassed - lemur/certificates/service.py:1120 — plugin = plugins.get(certificate.authority.pluginname); plugin.revokecertificate(certificate, reason) - lemur/plugins/lemuracme/acmehandlers.py:268 — ACME revokes by certificate.body - lemur/plugins/lemurdigicert/plugin.py:477, lemur/plugins/lemurentrust/plugin.py:321 — commercial CAs revoke by certificate.externalid - lemur/certificates/schemas.py:290 — CertificateOutputSchema exposes externalid, body, authority to any authenticated user
Impact
A low-privileged authenticated insider (or holder of a stolen non-admin token/API key) can revoke any certificate managed by Lemur — including high-value certificates they do not own and certificates currently attached to live endpoints — directly at the issuing CA. Iterating over GET /certificates yields fleet-wide revocation (mass DoS of TLS endpoints) without ever passing an AuthorityPermission or CertificatePermission check on the victim certificate. This is exactly the "Revocation as DoS vector" scenario flagged in the threat model and additionally defeats the built-in "cannot revoke while attached to endpoint" safeguard.
Root cause
Revocation authority is bound to ownership of the Lemur DB row, not to the CA-side certificate identity. Because upload allows creating a second row that aliases the same CA-side certificate (same body / externalid / authority) without any uniqueness constraint or AuthorityPermission check, the attacker can manufacture a row they own and then exercise the creator-bypass on revoke. The endpoint-attached guard inspects only the duplicate row's cert.endpoints, which is empty.
Validated evidence
Static path trace, confirmed by code inspection (validation status: CONFIRMED):
- Upload is gated only by StrictRolePermission (default-open to any non-read-only user) and accepts attacker-chosen authority + externalid + body without an AuthorityPermission check. - Certificate.body / externalid have no uniqueness constraint, so a duplicate row is created. - The revoke endpoint short-circuits the owner check when caller is the row creator, and the endpoint-attached guard inspects only the duplicate row. - Issuer plugins revoke at the CA using body / externalid taken from the duplicate row under the authority's stored CA credentials.
Proof of concept / reproducer
Status: reconstructed from source report (static control-flow trace; not executed against a live CA — revoking at a real CA is destructive).
Preconditions: attacker is an authenticated Lemur user holding any role other than read-only. <VICTIMCERTID> is any certificate id readable via GET /api/1/certificates.
bash 1. Read the victim's body / authority / externalid (exposed to any authenticated user) curl -sS "<TARGETBASEURL>/api/1/certificates/<VICTIMCERTID>" \ -H "Authorization: Bearer <AUTHTOKEN>" \ | jq '{body, externalid, authority: .authority.id}'
2. Upload a duplicate row aliasing the same CA-side certificate curl -sS -X POST "<TARGETBASEURL>/api/1/certificates/upload" \ -H "Authorization: Bearer <AUTHTOKEN>" \ -H "Content-Type: application/json" \ -d '{ "name": "victim-dup", "owner": "attacker@example.com", "body": "<VICTIMBODYPEM>", "authority": {"id": <VICTIMAUTHORITYID>}, "externalId": "<VICTIMEXTERNALID>" }' → returns {"id": <DUPID>, ...}; attacker is now cert.user of <DUPID>
3. Revoke the duplicate — issuer plugin revokes at the CA by body/externalid curl -sS -X PUT "<TARGETBASEURL>/api/1/certificates/<DUPID>/revoke" \ -H "Authorization: Bearer <AUTHTOKEN>" \ -H "Content-Type: application/json" \ -d '{"crlReason": "unspecified"}'
Static-trace validation command from the source report:
bash grep -n 'StrictRolePermission' lemur/certificates/views.py | grep -v Authority grep -n 'cert.authority = kwargs.get' lemur/certificates/service.py grep -n 'g.currentuser != cert.user' lemur/certificates/views.py grep -n 'certificate.externalid\|certificate.body' \ lemur/plugins/lemuracme/acmehandlers.py \ lemur/plugins/lemurdigicert/plugin.py \ lemur/plugins/lemurentrust/plugin.py
Source artifact: audit/harnesses/public-repo-threat-model-harness/results/netflix-lemur-100run-mythos-20260627T051129Z/findings.jsonl (run050, finding cluster lemur-revoke-via-duplicate, 2/100 runs).
Suggested fix
Decouple CA-side revocation authority from Lemur row ownership:
1. On POST /certificates/upload, if authority is supplied enforce AuthorityPermission for that authority, and reject/ignore caller-supplied externalid. 2. Before calling plugin.revokecertificate, look up all Certificate rows sharing the same (authorityid, serial) or body and require CertificatePermission on every match (and run the endpoint-attached check against all matches). 3. Consider a DB uniqueness constraint or dedup on (authorityid, serial) so a second row for the same CA-issued certificate cannot be created. 4. Stop exposing externalid in CertificateOutputSchema to non-owners.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/lemurto a version that resolves this vulnerability.Fixed in 1.9.3 - Configuration
Before calling plugin.revoke_certificate(certificate, reason), look up all Certificate rows sharing the same (authority_id, serial) or body and enforce CertificatePermission on every match; run the endpoint-attached safeguard against all matches (not only the duplicate row).
lemur/certificates/views.py (revoke endpoint) owner check / creator-bypass logic = require CertificatePermission on every matching Certificate row; do endpoint-attached check against all matches - Configuration
On POST /api/1/certificates/upload, if authority is supplied enforce AuthorityPermission for that authority; reject/ignore caller-supplied external_id (do not allow attacker-controlled aliasing of CA-side certificate identity).
lemur/certificates/views.py + lemur/certificates/service.py (upload flow) authority/external_id authorization and binding = enforce AuthorityPermission for supplied authority; reject/ignore caller-supplied external_id - Configuration
Add a DB uniqueness constraint or dedup so a second Certificate row for the same CA-issued certificate cannot be created; specifically prevent creating duplicates that alias the same CA-side certificate identity (the report notes no uniqueness constraint on Certificate.body/serial/external_id, and only name is unique).
lemur/certificates/models.py (Certificate uniqueness / deduplication) uniqueness constraints on Certificate.body / serial / external_id = add uniqueness constraint or dedup to prevent duplicate rows for same CA-issued certificate (e.g., on (authority_id, serial)) - Configuration
Stop exposing external_id in CertificateOutputSchema to non-owners; the finding states external_id/body/authority are exposed to any authenticated user via CertificateOutputSchema, enabling attackers to capture the CA-side identifiers used for revocation.
lemur/certificates/schemas.py (CertificateOutputSchema) external_id exposure = do not expose external_id (and related CA-side identifiers) to non-owners - Compensating control
Ensure callers without appropriate permissions cannot enumerate or access revocation-relevant fields fleet-wide via GET /certificates; the report flags that iterating over GET /certificates yields fleet-wide revocation capability without passing AuthorityPermission/CertificatePermission checks.
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Users who can pass StrictRolePermission and can read certificate details are exposed. They can create a duplicate database row for a target certificate and use ownership of that row to bypass CertificatePermission checks during revocation.
What information and access does an attacker need?
The attacker needs the target certificate's public body, authority ID, and external ID, which are available through GET /certificates/<id>. They also need permission to upload certificates; no AuthorityPermission check is performed when the upload resolves the supplied authority.
Which deployments are at risk?
The issue affects deployments where users permitted by StrictRolePermission can upload certificate records and where Lemur has stored CA credentials for the referenced authority. The revocation is performed by Lemur against the CA using those credentials, including for ACME, DigiCert, Entrust, Google CA, and CFSSL authorities.
How can defenders look for potential exploitation?
Review certificate upload records for duplicate body, serial, or external_id values, especially rows created by users who would not normally have permission over the affected certificate. Compare duplicate rows' authority and external_id values with production certificates and investigate subsequent revoke requests.
What can be done if patching is not immediately possible?
Restrict certificate-upload access to trusted administrators and prevent untrusted users from reading certificate details until the fix is applied. Review and tightly limit the roles that satisfy StrictRolePermission, particularly for users who can access certificate APIs.