Use of Cache Containing Sensitive Information Affecting org.apache.camel:camel-oauth package, versions [4.19.0, 4.22.2)

Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via the OAuthClientCredentialsTokenResolver in the camel-oauth component. When a deployment defines multiple profiles with the same token endpoint and client ID but different scopes or client secrets, the shared cache can return one profile’s bearer token for another profile’s outbound request without authenticating with that profile’s credentials. A hostile or compromised service receiving the request can replay the token within its scope, potentially gaining access beyond the calling profile’s intended scope or to a different service.

Notes

• Token reuse requires caching to be enabled, which is the default; with caching disabled, each resolution requests a token using that profile’s own configuration.
• The profiles must resolve within the same JVM: the cache is static and shared across resolver instances and CamelContexts there, not across separate JVMs.

Workarounds

• Set camel.oauth.NAME.cache-tokens=false for each named OAuth profile that shares a token endpoint and client ID with another profile, or camel.oauth.cache-tokens=false for the default profile. This prevents reuse of another profile’s cached token by requesting a token with the profile’s own scope and client secret on each resolution.
• Register a separate client at the identity provider for each profile that needs a different scope or client secret. This prevents those profiles from sharing a client ID and cache entry.

• Apache Jira Issues
• camel.apache.org
• camel.apache.org
• GitHub Commit camel-4.22.2
• GitHub Commit camel-4.23.0
• GitHub PR
• GitHub PR