Netflix Lemur versions before 1.9.3 contain a SSRF vulnerability (CWE-918) where an attacker with authority-role privileges can update the acme_url via the PUT /api/1/authorities/ endpoint without revalidation. This allows directing the Lemur ClientV2 to an attacker-controlled ACME server. Since the ACME directory and order responses include URLs (newNonce, newOrder, authorizations, finalize) chosen by the attacker, the client follows these URLs without verifying that their hosts match the configured directory host. This behavior enables the attacker to cause the client to send JWS-signed requests to internal services or cloud metadata endpoints. The vulnerability does not require global admin rights but does require an ACME authority and authorized user. The fix in version 1.9.3 revalidates updates and introduces a pinned client network to restrict allowed hosts in the ACME flow.

An attacker with authority-role access can exploit this SSRF vulnerability to make the Lemur client send signed requests to internal or cloud metadata endpoints, potentially leading to unauthorized access or information disclosure. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. However, exploitation requires specific privileges (authority role) and does not require global administrator rights.

Upgrade Lemur to version 1.9.3 or later, where the vulnerability is fixed by revalidating acme_url updates and enforcing a single allowed host for the ACME flow. No additional mitigation is required if the system is updated to this version.