Relative Path Traversal Affecting org.apache.camel:camel-azure-storage-datalake package, versions [4.0.0,4.14.9)[4.15.0,4.18.4)[4.19.0,4.22.0)

Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes. The component builds the local destination directly from the remote blob name, so a maliciously named blob is downloaded to an attacker-chosen filesystem location with the Camel process’s privileges. Depending on what path is targeted, this can corrupt application files or place data outside the intended download directory.

Workarounds

• Constrain the names the consumer will act on with the regex endpoint option so only simple single-segment blob names are accepted; this filters out names containing / or ../ before an exchange is created.
• Use the prefix endpoint option to narrow which blobs are listed server-side; this reduces exposure to untrusted blob names, especially when combined with regex for stricter filtering.
• Avoid downloadBlobToFile on containers that untrusted parties can write to, and write the payload under a file name controlled by the route instead of using the remote blob name; this prevents attacker-supplied blob names from steering writes outside the intended directory.

• camel.apache.org
• GitHub Commit camel-4.14.9
• GitHub Commit camel-4.18.4
• GitHub Commit camel-4.22.0
• GitHub Pull Request
• GitHub Pull Request
• GitHub Pull Request
• GitHub Pull Request