Netflix Lemur versions before 1.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) where an attacker with authority-role privileges can update the acme_url via the PUT /api/1/authorities/ endpoint without revalidation. This allows directing the Lemur ClientV2 to an attacker-controlled ACME server. The ACME directory and order responses include URLs (newNonce, newOrder, authorizations, finalize) that the client follows without verifying the host matches the configured directory host. Consequently, JWS-signed requests can be sent to internal services or cloud metadata endpoints, potentially exposing sensitive information or enabling further attacks. The vulnerability does not require global administrator privileges but does require the user to be authorized for the ACME authority. The issue is resolved in Lemur version 1.9.3 by adding revalidation of updates and introducing a _PinnedClientNetwork to enforce a single allowed host for the ACME flow.

An attacker with authority-role access can exploit this SSRF vulnerability to cause the Lemur client to send signed requests to internal or cloud metadata endpoints, potentially leading to information disclosure or unauthorized actions within internal services. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:L/I:L/A:L). It does not require global admin privileges but does require authority membership, limiting the attacker scope to authorized users.

Upgrade Lemur to version 1.9.3 or later, where the vulnerability is fixed by revalidating acme_url updates and enforcing host pinning for the ACME client network. Until the upgrade, restrict authority-role membership to trusted users only. Patch status is confirmed fixed in version 1.9.3.