Information Exposure Affecting org.apache.camel:camel-coap package, versions [4.0.0,4.18.5)[4.19.0,4.22.2)

Affected versions of this package are vulnerable to Information Exposure via the CamelCoapResource in the CoAP consumer. An attacker can read internal class and package names, values such as file paths, and backend details carried in exception messages by sending a CoAP request that makes a route’s completed response fail conversion; the consumer returns that response-building exception message in the 5.00 payload. This requires a route whose response the remote client can make unconvertible after the route completes; route failures themselves are answered with 2.05 Content and the message body present at that point, not with the route exception message.

Workarounds

• Convert each CoAP route’s final response body to byte[] or String as the route’s last step, and set CamelCoapMaxAge and CamelCoapETag only to values of their expected types. This prevents response-building conversion failures after the route completes.
• Add an onException handler that marks the failure as handled and explicitly sets the response body. This handles conversion failures inside the route, rather than allowing the CoAP consumer to return their exception messages to clients.

• Apache Jira Issues
• camel.apache.org
• GitHub Commit camel-4.18.5
• GitHub Commit camel-4.22.2
• GitHub Commit camel-4.23.0
• GitHub PR
• GitHub PR
• GitHub PR