Deserialization of Untrusted Data Affecting org.apache.camel:camel-pqc package, versions [4.18.0,4.18.3)[4.19.0,4.21.0)

Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the deserializeMetadata paths in AwsSecretsManagerKeyLifecycleManager, HashicorpVaultKeyLifecycleManager, and the legacy metadata migration path in FileBasedKeyLifecycleManager. An attacker can trigger arbitrary readObject() behavior by supplying crafted Base64-encoded serialized key metadata in the secret backend or legacy file format. When the PQC key lifecycle managers read metadata during normal key loading or migration, they deserialize attacker-controlled objects before any type check, so a malicious payload can execute in the application's process. This can lead to code execution in deployments that let an attacker write the camel-pqc metadata stored in HashiCorp Vault, AWS Secrets Manager, or legacy on-disk metadata files.

Notes

• Legacy .key and .metadata files are still deserialized during migration, so a malicious on-disk payload only matters where operators preserve or import the old Java-serialized file format; deployments that already store PQC metadata as JSON are outside that path.
• In the Vault and AWS managers, the legacy serialized KeyMetadata is wrapped inside the secret value as a metadata field, so the dangerous object graph sits in the inner payload rather than the secret envelope itself.

Workarounds

• Restrict write access to the camel-pqc key backend so only the application’s own identity can write the key metadata: use least-privilege HashiCorp Vault policies for the KV path, or limit AWS permissions to secretsmanager:PutSecretValue for the relevant secret. This prevents a less-trusted principal from planting crafted serialized metadata that would be deserialized during key loading.
• Keep PQC key material in a backend separate from any storage that less-trusted principals can write to. This limits the blast radius by preventing attackers with write access elsewhere from reaching the metadata that the key lifecycle managers deserialize.

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory