Improper Neutralization of Special Elements Used in a Template Engineorg.apache.camel:camel-http-common is a versatile open-source integration framework based on known Enterprise Integration Patterns.
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply {{...}} placeholders in a CamelHttpUri or CamelRestHttpUri override, causing HttpHelper, HttpMethodHelper, NettyHttpHelper, UndertowHelper, or VertxHttpHelper to evaluate them against application properties, environment variables, registered property functions, and Camel beans; this can expose secrets in outbound requests and invoke no-argument bean methods. A static producer URI is sufficient, and an exposed HTTP consumer may populate CamelHttpUri directly from the incoming request line, so the attack does not always require injecting a Camel header.
Notes
- On the header-to-producer step,
bridgeEndpoint=true does not reliably block placeholder evaluation: createMethod still resolves CamelHttpUri, and CamelRestHttpUri is consumed before bridge checks. Only camel-http offers the skipControlHeaders opt-out, which defaults to false.
Workarounds
- Before the producer, remove
CamelHttpUri and CamelRestHttpUri with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri") at the trust boundary to prevent message-supplied URI values from reaching placeholder evaluation.
- For
camel-http endpoints, set skipControlHeaders=true to prevent control headers from supplying URI overrides.
- On consumers exposed to untrusted senders, apply a strict inbound
HeaderFilterStrategy over the Camel namespace to block attacker-supplied Camel headers from reaching producers.
- Resolve secrets through a vault rather than environment variables or JVM system properties, limiting disclosure of secrets through placeholder evaluation.
How to fix Improper Neutralization of Special Elements Used in a Template Engine? Upgrade org.apache.camel:camel-http-common to version 4.18.5, 4.22.1 or higher.
| [4.0.0,4.18.5)[4.19.0,4.22.1) |
