Cross-site Request Forgery (CSRF) Affecting org.apache.camel:camel-oauth package, versions [4.11.0,4.18.5)[4.19.0,4.22.1)

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the OAuthCodeFlowCallback in the camel-oauth component. An attacker can silently sign a victim into an attacker-controlled account by obtaining an authorization code in their own browser and inducing the victim’s browser to send it to the callback, which redeems the code and associates the resulting profile with the session without verifying that the session started the authorization flow; the victim’s subsequent actions and submitted data then go to the attacker’s account. The callback also allows the post-authentication redirect target to be influenced, enabling an open redirect from the trusted origin.

Notes

• The cross-site callback can carry the victim’s OAuth session because the session cookie is configured SameSite=None; Secure, allowing the browser to send it with a cross-site request.

Workarounds

• For deployments that cannot upgrade immediately, terminate the authorization-code flow in a component that performs its own state binding instead of relying on Camel’s callback; this prevents an attacker-obtained authorization code from being attached to a victim’s session.

• Apache Jira Issues
• camel.apache.org
• GitHub Commit camel-4.18.5
• GitHub Commit camel-4.22.1
• GitHub Commit camel-4.23.0