org.apache.camel:camel-azure-storage-blob@4.0.0

Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes. The component builds the local destination directly from the remote blob name, so a maliciously named blob is downloaded to an attacker-chosen filesystem location with the Camel process’s privileges. Depending on what path is targeted, this can corrupt application files or place data outside the intended download directory.

Workarounds

• Constrain the names the consumer will act on with the regex endpoint option so only simple single-segment blob names are accepted; this filters out names containing / or ../ before an exchange is created.
• Use the prefix endpoint option to narrow which blobs are listed server-side; this reduces exposure to untrusted blob names, especially when combined with regex for stricter filtering.
• Avoid downloadBlobToFile on containers that untrusted parties can write to, and write the payload under a file name controlled by the route instead of using the remote blob name; this prevents attacker-supplied blob names from steering writes outside the intended directory.

Upgrade org.apache.camel:camel-azure-storage-blob to version 4.14.9, 4.18.4, 4.22.0 or higher.