Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lemur | pip | < 1.9.3 | 1.9.3 |
Miggo AIRoot Cause AnalysisThe vulnerability was a result of missing authorization on multiple GET endpoints within the Lemur destinations API. Specifically, the DestinationsList.get, Destinations.get, and CertificateDestinations.get methods in lemur/destinations/views.py were only protected by a login_required check, allowing any authenticated user, regardless of their role, to access sensitive destination information. The vulnerability was compounded by the DestinationOutputSchema.fill_object function in lemur/destinations/schemas.py, which serialized all destination options, including plaintext credentials like SFTP passwords, without any redaction. An attacker could exploit this by making an authenticated GET request to the vulnerable endpoints to retrieve these secrets. The patch addressed this by adding a strict @admin_permission.require decorator to the affected GET methods and by implementing a redaction mechanism in DestinationOutputSchema.fill_object to nullify the values of any options marked as 'sensitive' before they are included in the API response.
DestinationsList.getlemur/destinations/views.py
Destinations.getlemur/destinations/views.py
CertificateDestinations.getlemur/destinations/views.py
DestinationOutputSchema.fill_objectlemur/destinations/schemas.py