Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit 8669011203ca3dd89d9e39bab9ef6850eca723f9 clearly indicates that the vulnerability is located in the post method of the AuthoritiesList class in lemur/authorities/views.py. The vulnerability is a missing authorization check. Specifically, when a user attempts to create a sub-CA, the system did not verify if the user had permissions on the parent authority. This allowed a low-privileged user to create a sub-CA under any parent authority, effectively bypassing security controls. The provided patch directly addresses this by adding an explicit permission check for the parent authority within the post method. The added code snippet retrieves the parent from the request data and uses AuthorityPermission to validate the user's access rights before proceeding with the creation of the sub-CA. The test case added in the same commit further confirms this by simulating an unauthorized attempt to create a sub-CA, which is expected to fail with a 403 Forbidden status, thus validating the fix and confirming the location of the original flaw.
AuthoritiesList.postlemur/authorities/views.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| lemur | pip | <= 1.9.2 | 1.9.3 |