Server-Side Request Forgery (SSRF) Affecting org.apache.camel:camel-core package, versions [2.17.0,2.17.6) [2.18.0,2.18.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHECAMEL-31386
- published 10 Apr 2017
- disclosed 23 Feb 2017
- credit Franz Forsthofer
Introduced: 23 Feb 2017
CVE-2017-5643 Open this link in a new tabHow to fix?
Upgrade org.apache.camel:camel-core to version 2.17.6, 2.18.3 or higher.
Overview
org.apache.camel:camel-core is a versatile open-source integration framework based on known Enterprise Integration Patterns.
The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources.