org.apache.camel:camel-smooks@4.20.0

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection through XML parsing in the Smooks data format (SmooksDataFormat) and smooks: component (SmooksProcessor) in camel-smooks. An attacker can read files accessible to the Camel process or make it send requests to internal network hosts by supplying an XML message body with an external entity declaration; when Smooks uses its default reader, it resolves the entity during unmarshalling and includes the resolved content in the result returned on InOut routes.

Notes

• The parsing step is affected only when Smooks uses its default XML reader; configurations declaring their own reader, such as EDI, CSV, JSON, or a custom reader, are not affected.

Workarounds

• Do not apply camel-smooks to XML received from untrusted senders; this prevents attacker-supplied external entities from being resolved to read local files or make requests to internal hosts.

Upgrade org.apache.camel:camel-smooks to version 4.18.5, 4.22.1 or higher.