Arbitrary Code Injection Affecting org.apache.camel:camel-dynamic-router package, versions [4.4.0,4.18.5)[4.19.0,4.22.1)

Affected versions of this package are vulnerable to Arbitrary Code Injection via DynamicRouterControlProducer in the dynamic-router-control component. An attacker can execute a supplied expression with the Camel process’s privileges by sending a subscribe or update control message containing a predicate and expression-language name to a transport routed to a dynamic-router-control endpoint; the compiled predicate is evaluated against exchanges routed through that channel, potentially enabling arbitrary code execution and compromising the application.

Notes

• Reaching the control endpoint requires the attacker to be able to send on a transport whose route forwards messages to it; the endpoint adds no separate authentication or user-interaction requirement.

Workarounds

• Do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint; this prevents untrusted senders from supplying subscription expressions for evaluation.
• If control messages must cross such a transport, authenticate senders and remove the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers, and clear the predicate and expressionLanguage fields from any DynamicRouterControlMessage before it reaches the endpoint. This keeps those expression inputs from being supplied by the message.
• Restrict who can send to transports that feed a dynamic-router-control endpoint; this limits who can reach the vulnerable control path.

• Apache Jira Issues
• camel.apache.org
• GitHub Commit
• GitHub Commit
• GitHub Commit