[<prev] [next>] [day] [month] [year] [list]
Message-ID: <3b2d9efb-42ae-925c-bc05-c167d40bdd90@apache.org>
Date: Sun, 09 Mar 2025 10:40:03 +0000
From: Andrea Cosentino <acosentino@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-27636: Apache Camel: Camel Message Header Injection via
Improper Filtering
Severity: moderate
Affected versions:
- Apache Camel 4.10.0 before 4.10.2
- Apache Camel 4.8.0 before 4.8.5
- Apache Camel 3.10.0 before 3.22.4
Description:
Bypass/Injection vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.
Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.
The vulnerability arises due to a bug in the default filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel.". Attackers can bypass this filter by altering the casing of letters. This allows attackers to inject headers which can be exploited to invoke arbitrary methods from the Bean registry and also supports using Simple Expression Language (or OGNL in some cases) as part of the method parameters passed to the bean. It's important to note that only methods in the same bean declared in the bean URI could be invoked.
Mitigation: You can easily work around this in your Camel applications by removing the headers in your Camel routes. There are many ways of doing this, also globally or per route. This means you could use the removeHeaders EIP, to filter out anything like "cAmel, cAMEL" etc, or in general everything not starting with "Camel", "camel" or "org.apache.camel.".
This issue is being tracked as CAMEL-21838
Credit:
Mark Thorson (finder)
References:
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-27636
https://issues.apache.org/jira/browse/CAMEL-21838
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
