Deserialization of Untrusted Data Affecting org.apache.camel:camel-pqc package, versions [4.18.0,4.18.3)[4.19.0,4.21.0)

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through deserializeMetadata() when it reads key metadata from AWS Secrets Manager. An attacker who can write the secret that holds the PQC key metadata can supply a crafted Base64-encoded Java serialization payload, causing ObjectInputStream.readObject() to instantiate attacker-controlled objects during normal key metadata loading and potentially execute code in the application process. The vulnerable path is used when the application retrieves and processes stored key metadata, so a malicious secret can compromise the service that manages PQC keys. This can lead to arbitrary code execution in the context of that application and disrupt key lifecycle operations.

Notes

• Legacy metadata written by older Camel versions remains readable for migration, so the vulnerable deserialization path is only exercised when a deployment encounters pre-JSON camel-pqc metadata during normal lifecycle operations.
• The AWS Secrets Manager path is gated by write access to the specific secret that stores PQC key metadata; the maintainer's advisory calls out secretsmanager:PutSecretValue on that secret as the principal capability needed to plant the payload.

Workarounds

• Restrict secretsmanager:PutSecretValue on the AWS Secrets Manager secret that stores the camel-pqc key metadata so only the application’s own identity can write to it; this blocks attackers with write access from planting a crafted serialized payload.
• Keep the PQC key material in a separate AWS Secrets Manager secret from any data writable by less-trusted principals; this limits the blast radius if another secret is writable by those principals.

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

• Apache Advisory
• GitHub Commit
• GitHub Commit