Executive brief
Lemur is a certificate management platform used to issue and verify X.509 certificates. An incomplete fix for a prior SSRF vulnerability allows authenticated operators to force Lemur to make requests to internal networks and cloud metadata services by crafting certificates with malicious revocation URLs. The attacker can cause the application to reach unreachable internal services and retrieve metadata, potentially leading to account compromise or cloud infrastructure misconfiguration exposure.
Technical details
The vulnerability exists in the certificate revocation checking logic (lemur/certificates/verify.py). Two attack vectors bypass the URL validation: (1) HTTP redirect — the validator checks only the initial URL, but `requests.get()` automatically follows redirects without re-validation, allowing redirect to internal targets; (2) DNS rebinding/TOCTOU — the validator resolves the hostname once during validation, but the actual CRL/OCSP fetch re-resolves independently, allowing a low-TTL name to answer a public IP at check time and an internal IP at fetch time. Exploitation requires operator-level privileges to POST a crafted certificate to `/api/1/certificates/upload` with attacker-controlled `crlDistributionPoints` or OCSP URL extensions. When certificate verification runs (e.g., check_revocation task), the blind SSRF reaches internal services and metadata endpoints (169.254.169.254); responses are parsed as CRL data and discarded. Fixed in version 1.9.3.
Affected products
- Netflix Lemur < 1.9.3
Timeline
- 2026-08-18: disclosed: GitHub Advisory published
- 2026-08-18: patched: Fixed in version 1.9.3
References
- https://api.github.com/users/abhinav9-coder
- https://github.com/abhinav9-coder
- https://api.github.com/users/abhinav9-coder/gists%7B/gist_id%7D
- https://api.github.com/users/abhinav9-coder/repos
- https://avatars.githubusercontent.com/u/73783498?v=4
- https://api.github.com/users/abhinav9-coder/events%7B/privacy%7D