Improper Neutralization of Special Elements Used in a Template Engineorg.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns.
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply {{...}} placeholders in a CamelHttpUri or CamelRestHttpUri override, causing HttpHelper, HttpMethodHelper, NettyHttpHelper, UndertowHelper, or VertxHttpHelper to evaluate them against application properties, environment variables, registered property functions, and Camel beans; this can expose secrets in outbound requests and invoke no-argument bean methods. A static producer URI is sufficient, and an exposed HTTP consumer may populate CamelHttpUri directly from the incoming request line, so the attack does not always require injecting a Camel header.
Notes
- On the header-to-producer step,
bridgeEndpoint=true does not reliably block placeholder evaluation: createMethod still resolves CamelHttpUri, and CamelRestHttpUri is consumed before bridge checks. Only camel-http offers the skipControlHeaders opt-out, which defaults to false.
Workarounds
- Before the producer, remove
CamelHttpUri and CamelRestHttpUri with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri") at the trust boundary to prevent message-supplied URI values from reaching placeholder evaluation.
- For
camel-http endpoints, set skipControlHeaders=true to prevent control headers from supplying URI overrides.
- On consumers exposed to untrusted senders, apply a strict inbound
HeaderFilterStrategy over the Camel namespace to block attacker-supplied Camel headers from reaching producers.
- Resolve secrets through a vault rather than environment variables or JVM system properties, limiting disclosure of secrets through placeholder evaluation.
How to fix Improper Neutralization of Special Elements Used in a Template Engine? Upgrade org.apache.camel:camel-http to version 4.18.5, 4.22.1 or higher.
| [4.0.0,4.18.5)[4.19.0,4.22.1) |
Use of Cache Containing Sensitive Informationorg.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns.
Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the OAuth2 token cache in the camel-http component. The JVM-wide cache keys tokens by request URI and client credentials, so when multiple routes share those values but differ in scope, resource indicator, or token endpoint, a token minted for one configuration can be used by another. An attacker who can invoke such a route can trigger an outbound request carrying a token with broader authority than configured or one issued by a different authorization server; this requires those distinct OAuth2 configurations to run in the same JVM.
Workarounds
- Run endpoints that differ in scope, resource indicator, or token endpoint in separate JVMs to prevent them from sharing cached tokens.
How to fix Use of Cache Containing Sensitive Information? Upgrade org.apache.camel:camel-http to version 4.18.5, 4.22.1 or higher.
| [4.0.0,4.18.5)[4.19.0,4.22.1) |
Insertion of Sensitive Information Into Sent Dataorg.apache.camel:camel-http is a versatile open-source integration framework based on known Enterprise Integration Patterns.
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the OAuth2ClientConfigurer and basic/digest credential-provider handling in the camel-http component. With followRedirects=true, an attacker can obtain an OAuth2 bearer token by causing the endpoint’s remote server to redirect to an attacker-controlled host; for basic/digest authentication, when authHost is unset, the credentials match any host and are offered if the redirect target issues an authentication challenge. This exposes the configured credentials to the redirect target.
Notes
- At the redirect step, the attacker must control the remote endpoint or be able to influence its responses so it returns a redirect to the attacker-controlled host.
Workarounds
- Set
followRedirects=false on Camel HTTP endpoints that carry credentials, and handle redirects explicitly in the route so the remote server cannot choose a destination that receives those credentials.
How to fix Insertion of Sensitive Information Into Sent Data? Upgrade org.apache.camel:camel-http to version 4.18.5, 4.22.1 or higher.
| [4.0.0,4.18.5)[4.19.0,4.22.1) |
