Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') Affecting org.apache.camel:camel-aws2-s3 package, versions [4.8.0,4.18.5)[4.19.0,4.22.2)

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') via the determineKey function in the camel-aws2-s3 component. An attacker who can upload objects to a bucket consumed by a Camel route can include Simple expression markers in an object name; the consumer places that name in the CamelAwsS3Key header, which the producer evaluates even when keyName is configured. The attacker can cause expressions to run in the Camel process, exposing JVM, environment, or configuration values through destination object names if they can inspect that bucket, or invoking registry beans when camel-bean is available and triggering method side effects.

Workarounds

• Before an aws2-s3 producer, remove the CamelAwsS3Key header with removeHeader("CamelAwsS3Key") so the producer uses the endpoint’s configured keyName instead of evaluating a key supplied by the message.
• Alternatively, reject exchanges whose CamelAwsS3Key header contains ${ or $simple{ to prevent those values from reaching the producer for evaluation.
• Allow only trusted principals to write to buckets consumed by Camel routes, preventing untrusted users from supplying object names that can reach an aws2-s3 producer.

• Apache Jira Issues
• Apache Jira Issues
• camel.apache.org
• GitHub Commit camel-4.18.5
• GitHub Commit camel-4.22.2
• GitHub Commit camel-4.23.0
• GitHub PR
• GitHub PR
• GitHub PR
• GitHub PR
• GitHub PR