PT-2026-80301 · Pypi · Lemur

Published

2026-08-18

·

Updated

2026-08-18

CVSS v3.1

7.3

High

VectorAV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Summary

Repo under test: https://github.com/Netflix/lemur
PUT /api/1/certificates/<id>/revoke authorizes the caller against the Lemur database row (creator == current user, or CertificatePermission over the row's roles) rather than the underlying CA-side certificate identity. Separately, POST /api/1/certificates/upload lets any user passing StrictRolePermission create a new Certificate row while freely supplying body, authority (resolved by id/name with no AuthorityPermission check) and external id; there is no uniqueness constraint on body, serial, or external id.
An attacker can therefore read a target certificate's public body, authority.id, and external id via GET /certificates/<id>, upload a duplicate row, and revoke that duplicate. The creator-bypass skips CertificatePermission, the empty-endpoints check passes because the duplicate has none, and service.revoke() then revokes at the CA using the attacker-supplied body (ACME) or external id (DigiCert/Entrust/Google CA/CFSSL) under the authority's stored CA credentials — revoking the real production certificate.

Affected route

POST /api/1/certificates/upload → PUT /api/1/certificates/<dup id>/revoke

Affected code

Impact

A low-privileged authenticated insider (or holder of a stolen non-admin token/API key) can revoke any certificate managed by Lemur — including high-value certificates they do not own and certificates currently attached to live endpoints — directly at the issuing CA. Iterating over GET /certificates yields fleet-wide revocation (mass DoS of TLS endpoints) without ever passing an AuthorityPermission or CertificatePermission check on the victim certificate. This is exactly the "Revocation as DoS vector" scenario flagged in the threat model and additionally defeats the built-in "cannot revoke while attached to endpoint" safeguard.

Root cause

Revocation authority is bound to ownership of the Lemur DB row, not to the CA-side certificate identity. Because upload allows creating a second row that aliases the same CA-side certificate (same body / external id / authority) without any uniqueness constraint or AuthorityPermission check, the attacker can manufacture a row they own and then exercise the creator-bypass on revoke. The endpoint-attached guard inspects only the duplicate row's cert.endpoints, which is empty.

Validated evidence

Static path trace, confirmed by code inspection (validation status: CONFIRMED):
  • Upload is gated only by StrictRolePermission (default-open to any non-read-only user) and accepts attacker-chosen authority + external id + body without an AuthorityPermission check.
  • Certificate.body / external id have no uniqueness constraint, so a duplicate row is created.
  • The revoke endpoint short-circuits the owner check when caller is the row creator, and the endpoint-attached guard inspects only the duplicate row.
  • Issuer plugins revoke at the CA using body / external id taken from the duplicate row under the authority's stored CA credentials.

Proof of concept / reproducer

Status: reconstructed from source report (static control-flow trace; not executed against a live CA — revoking at a real CA is destructive).
Preconditions: attacker is an authenticated Lemur user holding any role other than read-only. <VICTIM CERT ID> is any certificate id readable via GET /api/1/certificates.
bash
# 1. Read the victim's body / authority / external id (exposed to any authenticated user)
curl -sS "<TARGET BASE URL>/api/1/certificates/<VICTIM CERT ID>" 
 -H "Authorization: Bearer <AUTH TOKEN>" 
 | jq '{body, external id, authority: .authority.id}'

# 2. Upload a duplicate row aliasing the same CA-side certificate
curl -sS -X POST "<TARGET BASE URL>/api/1/certificates/upload" 
 -H "Authorization: Bearer <AUTH TOKEN>" 
 -H "Content-Type: application/json" 
 -d '{
    "name": "victim-dup",
    "owner": "attacker@example.com",
    "body": "<VICTIM BODY PEM>",
    "authority": {"id": <VICTIM AUTHORITY ID>},
    "externalId": "<VICTIM EXTERNAL ID>"
   }'
# → returns {"id": <DUP ID>, ...}; attacker is now cert.user of <DUP ID>

# 3. Revoke the duplicate — issuer plugin revokes at the CA by body/external id
curl -sS -X PUT "<TARGET BASE URL>/api/1/certificates/<DUP ID>/revoke" 
 -H "Authorization: Bearer <AUTH TOKEN>" 
 -H "Content-Type: application/json" 
 -d '{"crlReason": "unspecified"}'
Static-trace validation command from the source report:
bash
grep -n 'StrictRolePermission' lemur/certificates/views.py | grep -v Authority
grep -n 'cert.authority = kwargs.get' lemur/certificates/service.py
grep -n 'g.current user != cert.user' lemur/certificates/views.py
grep -n 'certificate.external id|certificate.body' 
 lemur/plugins/lemur acme/acme handlers.py 
 lemur/plugins/lemur digicert/plugin.py 
 lemur/plugins/lemur entrust/plugin.py
Source artifact: audit/harnesses/public-repo-threat-model-harness/results/netflix-lemur-100run-mythos-20260627T051129Z/findings.jsonl (run 050, finding cluster lemur-revoke-via-duplicate, 2/100 runs).

Suggested fix

Decouple CA-side revocation authority from Lemur row ownership:
  1. On POST /certificates/upload, if authority is supplied enforce AuthorityPermission for that authority, and reject/ignore caller-supplied external id.
  2. Before calling plugin.revoke certificate, look up all Certificate rows sharing the same (authority id, serial) or body and require CertificatePermission on every match (and run the endpoint-attached check against all matches).
  3. Consider a DB uniqueness constraint or dedup on (authority id, serial) so a second row for the same CA-issued certificate cannot be created.
  4. Stop exposing external id in CertificateOutputSchema to non-owners.

Fix

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-639

Related Identifiers

GHSA-PXMC-2FFP-8J67

Affected Products

Lemur