Improper Neutralization of Special Elements Used in a Template Engine Affecting org.apache.camel:camel-undertow package, versions [4.0.0,4.18.5)[4.19.0,4.22.1)

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the HTTP producer URI helpers in the camel-http-common, camel-http, camel-netty-http, camel-undertow, and camel-vertx-http components. An attacker can supply {{...}} placeholders in a CamelHttpUri or CamelRestHttpUri override, causing HttpHelper, HttpMethodHelper, NettyHttpHelper, UndertowHelper, or VertxHttpHelper to evaluate them against application properties, environment variables, registered property functions, and Camel beans; this can expose secrets in outbound requests and invoke no-argument bean methods. A static producer URI is sufficient, and an exposed HTTP consumer may populate CamelHttpUri directly from the incoming request line, so the attack does not always require injecting a Camel header.

Notes

• On the header-to-producer step, bridgeEndpoint=true does not reliably block placeholder evaluation: createMethod still resolves CamelHttpUri, and CamelRestHttpUri is consumed before bridge checks. Only camel-http offers the skipControlHeaders opt-out, which defaults to false.

Workarounds

• Before the producer, remove CamelHttpUri and CamelRestHttpUri with removeHeader("CamelHttpUri") and removeHeader("CamelRestHttpUri") at the trust boundary to prevent message-supplied URI values from reaching placeholder evaluation.
• For camel-http endpoints, set skipControlHeaders=true to prevent control headers from supplying URI overrides.
• On consumers exposed to untrusted senders, apply a strict inbound HeaderFilterStrategy over the Camel namespace to block attacker-supplied Camel headers from reaching producers.
• Resolve secrets through a vault rather than environment variables or JVM system properties, limiting disclosure of secrets through placeholder evaluation.

• Apache Jira Issues
• camel.apache.org
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR