Summary: CVE-2025-27636 in Apache Camel
Date: March 9, 2025
From: Andrea Cosentino
To: oss-security@…ts.openwall.com
Subject: CVE-2025-27636: Apache Camel: Camel Message Header Injection via Improper Filtering
Severity: Moderate
Affected Versions:
- Apache Camel 4.10.0 before 4.10.2
- Apache Camel 4.8.0 before 4.8.5
- Apache Camel 3.10.0 before 3.22.4
Vulnerability Description:
CVE-2025-27636 concerns a bypass/injection vulnerability affecting specific versions of Apache Camel. It is linked to an issue within the default header filtering mechanism that only blocks headers starting with "Camel", "camel", or "org.apache.camel." However, the filtering can be bypassed by attackers through the manipulation of letter casing, allowing them to inject custom headers.
As a result, this vulnerability can potentially enable attackers to invoke arbitrary methods from the Bean registry, utilizing methods declared in the bean URI. The exploitation can involve the use of Simple Expression Language (SEL) or OGNL (Object-Graph Navigation Language), which can be included in the method parameters passed to the bean.
This vulnerability affects the following versions:
- Apache Camel 4.10.0 to 4.10.1
- Apache Camel 4.8.0 to 4.8.4
- Apache Camel 3.10.0 to 3.22.3
Users of the affected versions are strongly encouraged to upgrade to:
- Version 4.10.2 for the 4.10.x LTS
- Version 4.8.5 for the 4.8.x LTS
- Version 3.22.4 for the 3.x releases
Mitigation Strategies:
To address the vulnerability in affected Camel applications, users can consider removing headers from Camel routes. This can be achieved through various methods, such as utilizing the removeHeaders Enterprise Integration Pattern (EIP) to filter out headers that are case variations of "Camel" or that do not start with "Camel", "camel", or "org.apache.camel." Consequently, this can remediate the vulnerability by ensuring the unwanted headers are stripped before they can be exploited.
This issue is documented under the Jira ticket CAMEL-21838 for further tracking and exploration.
Acknowledgment:
The vulnerability was discovered by Mark Thorson.
References:
For further information, please refer to:
Additional Resources:
For more insights on software security and mailing lists, users are encouraged to review the relevant wiki on open-source software security and familiarize themselves with mailing list protocols and proper messaging formats.
(Note: This summary distills the key points regarding the Apache Camel CVE-2025-27636 vulnerability and associated mitigation strategies for users and security professionals concerned with maintaining the security of their systems.)