Relative Path TraversalAffected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes. The component builds the local destination directly from the remote blob name, so a maliciously named blob is downloaded to an attacker-chosen filesystem location with the Camel process’s privileges. Depending on what path is targeted, this can corrupt application files or place data outside the intended download directory.
Workarounds
- Constrain the names the consumer will act on with the
regex endpoint option so only simple single-segment blob names are accepted; this filters out names containing / or ../ before an exchange is created.
- Use the
prefix endpoint option to narrow which blobs are listed server-side; this reduces exposure to untrusted blob names, especially when combined with regex for stricter filtering.
- Avoid
downloadBlobToFile on containers that untrusted parties can write to, and write the payload under a file name controlled by the route instead of using the remote blob name; this prevents attacker-supplied blob names from steering writes outside the intended directory.
How to fix Relative Path Traversal? Upgrade org.apache.camel:camel-azure-storage-datalake to version 4.14.9, 4.18.4, 4.22.0 or higher.
| [4.0.0,4.14.9)[4.15.0,4.18.4)[4.19.0,4.22.0) |
Relative Path TraversalAffected versions of this package are vulnerable to Relative Path Traversal via the downloadToFile operation, which constructs the local file path by directly joining the configured fileDir with the remote path name without validating or normalizing the resulting path. An attacker can create or overwrite arbitrary files on the local filesystem by supplying specially crafted path names containing parent-directory segments in the remote Data Lake filesystem, potentially leading to privilege escalation or loss of data integrity.
How to fix Relative Path Traversal? Upgrade org.apache.camel:camel-azure-storage-datalake to version 4.14.9, 4.18.4, 4.22.0 or higher.
| [4.0.0,4.14.9)[4.15.0,4.18.4)[4.19.0,4.22.0) |
