Improperly Controlled Modification of Dynamically-Determined Object Attributes Affecting org.apache.camel:camel-mail package, versions [,4.14.8)[4.15.0,4.18.3)[4.19.0,4.21.0)

org.apache.camel:camel-mail is a Camel Mail support.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes through MailProducer.getSender in the mail component. An attacker can weaken SMTP transport security or redirect the SMTP connection by sending mail.smtp.* or mail.smtps.* headers into a route that ends in an smtp or smtps producer. MailProducer.getSender treats those Camel-internal headers as JavaMail session properties on a per-message sender, so untrusted input from upstream protocols such as HTTP, JMS, or Kafka can override endpoint settings.

Workarounds

• Strip mail.smtp.* and mail.smtps.* headers before the route reaches any smtp or smtps producer, for example with removeHeaders('mail.smtp.*') and removeHeaders('mail.smtps.*') between untrusted ingress and the mail endpoint; this blocks attacker-supplied headers from overriding JavaMail session properties.
• Keep useJavaMailSessionPropertiesFromHeaders disabled on smtp / smtps producers unless the headers are produced only by trusted route logic; this prevents untrusted input from weakening transport security or redirecting the SMTP connection.

• GitHub Commit
• GitHub Commit
• GitHub Commit
• Maintainer's Advisory