Reliance on Untrusted Inputs in a Security Decision Affecting org.apache.camel:camel-core package, versions [4.0.0,4.18.5)[4.19.0,4.22.1)

org.apache.camel:camel-core is a powerful open source integration framework based on known Enterprise Integration Patterns with powerful bean integration.

Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the getCurrentSagaCoordinator function in the SagaProcessor component. In deployments using a saga service that consults the Long-Running-Action header, including those running sagas over an LRA coordinator, an attacker can make an inbound exchange join a long-running saga started by another participant by supplying a forged header when the exchange has no internal saga ID, causing the request and its compensation to be associated with an action the sender did not initiate. The header is outside Camel’s namespace, so consumer header filters do not block it.

Notes

• The header-to-coordinator lookup matters in deployments using an LRA coordinator for cross-participant saga joining; without that protocol, there is no external coordinator to join.

Workarounds

• On every consumer that accepts messages from an untrusted sender, strip the Long-Running-Action header with removeHeaders("Long-Running-Action") to prevent inbound messages from selecting a saga coordinator.

• Apache Jira Issues
• camel.apache.org
• GitHub Commit camel-4.18.5
• GitHub Commit camel-4.22.1
• GitHub Commit camel-4.23.0