External Control of Assumed-Immutable Web Parameter Affecting org.apache.camel:camel-atmosphere-websocket package, versions [4.0.0,4.14.9)[4.15.0,4.18.4)[4.19.0,4.22.0)

Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppress messages intended for connected WebSocket peers by sending crafted inbound HTTP headers that populate websocket.connectionKey.list or websocket.connectionKey and influence which client(s) receive the message. In routes that bridge an untrusted HTTP consumer into an atmosphere-websocket: producer, the producer accepts these header values from the inbound exchange and uses them to select the delivery target. This lets an external sender take over the dispatch decision, causing messages to be delivered to the wrong WebSocket connection or not delivered at all.

Workarounds

• Strip websocket.* dispatch headers at the trust boundary before the atmosphere-websocket: producer, for example with removeHeaders("websocket.*") between the HTTP consumer and the producer; this prevents an external sender from overriding websocket.connectionKey.list / websocket.connectionKey and hijacking recipient selection.
• Do not bridge an untrusted HTTP consumer directly into a header-driven atmosphere-websocket: producer unless you first remove the dispatch namespace; this prevents crafted inbound HTTP headers from redirecting or suppressing messages to connected WebSocket peers.

• camel.apache.org
• GitHub Commit
• GitHub Commit
• GitHub Commit