CyberRota Analysis
AI-GeneratedLemur versions prior to 1.9.3 have a vulnerability that allows read-only users to access sensitive credentials, such as passwords and private keys, stored in plaintext within the sftp-destination plugin. This exposure could lead to unauthorized access to SFTP systems and compromise TLS material, significantly impacting the security of remote certificate-deployment hosts. Organizations using Lemur for TLS certificate management should prioritize upgrading to version 1.9.3 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allowing even a read-only user to retrieve credentials for remote certificate-deployment hosts. The exposed credentials could permit direct access to SFTP systems and TLS material outside the Lemur security boundary. The fix requires administrator permission for destination reads and redacts options marked sensitive. This issue is fixed in version 1.9.3.