Improper Authentication Affecting org.apache.camel:camel-platform-http-main package, versions [4.8.0,4.22.0)

Affected versions of this package are vulnerable to Improper Authentication via the JWTAuthenticationConfigurer in components/camel-platform-http-main/src/main/java/org/apache/camel/component/platform/http/main/authentication/JWTAuthenticationConfigurer.java. An attacker can gain unauthorized access by sending any unexpired JWT signed by a key trusted by the configured keystore, even if the token was minted for a different issuer or audience. When jwtIssuer and jwtAudience were both unset, the embedded HTTP server and the management server accepted tokens after only signature and expiry checks, so the iss and aud claims were never enforced. This can let a foreign token authenticate successfully and expose protected platform HTTP endpoints and management endpoints to requests that should have been rejected.

Workarounds

• Configure camel.server.jwtIssuer and/or camel.server.jwtAudience for the embedded HTTP server so tokens are validated for the expected iss and aud claims, which prevents acceptance of foreign JWTs signed by a trusted keystore key.
• Configure camel.management.jwtIssuer and/or camel.management.jwtAudience for the embedded management server so tokens are validated for the expected iss and aud claims, which prevents acceptance of foreign JWTs on management endpoints.
• If you intentionally rely on signature-and-expiry-only validation, set camel.server.jwtAllowMissingIssuerAndAudience=true or camel.management.jwtAllowMissingIssuerAndAudience=true explicitly so the server starts with that reduced validation model; this avoids accidental deployment with weaker JWT checks than intended.

• camel.apache.org
• GitHub Commit
• GitHub PR