Kamalpreet Singh

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 **Description** Improper input validation in the Vertx Websocket component allows an unauthenticated remote attacker to perform Server-Side Request Forgery (SSRF) and expose sensitive information. The `camel-vertx-websocket` consumer maps inbound WebSocket query and path parameters into the Camel Exchange header map via the `populateExchangeHeaders()` function without applying a HeaderFilterStrategy. This allows attackers to set internal control headers, such as `CamelHttpUri`, by providing them as query parameters. If the consumer feeds a downstream HTTP producer, the injected `CamelHttpUri` redirects the server-side request to an attacker-controlled destination. Furthermore, the HTTP producer resolves Camel property placeholders within the URI, potentially disclosing environment variables, application properties, or vault secrets to the attacker. **Recommendations** Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. Strip Camel control headers from inbound messages before they reach downstream producers by using `removeHeaders('Camel*')` and `removeHeaders('camel*')` at the start of the route. Require authentication on the WebSocket endpoint. Avoid bridging an untrusted consumer directly into an HTTP producer whose target URI can be driven from message headers.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 **Description** Improper input validation in the Atmosphere WebSocket component allows an unauthenticated remote attacker to perform Server-Side Request Forgery (SSRF) and expose sensitive information. The `camel-atmosphere-websocket` consumer maps inbound WebSocket query parameters to the Camel Exchange header map without applying a `HeaderFilterStrategy` in the `WebsocketConsumer.sendEventNotification()` function. This allows an attacker to set internal control headers, such as `CamelHttpUri` (represented by the `Exchange.HTTP URI` variable), via query parameters. If the WebSocket consumer feeds into a downstream HTTP producer, the injected `CamelHttpUri` redirects the server-side request to an attacker-controlled destination. Furthermore, the HTTP producer resolves Camel property placeholders within the URI, potentially disclosing environment variables, application properties, and vault secrets to the attacker. **Recommendations** Update Apache Camel versions 4.0.0 through 4.14.7 to version 4.14.8. Update Apache Camel versions 4.15.0 through 4.18.2 to version 4.18.3. Update Apache Camel versions 4.19.0 through 4.20.9 to version 4.21.0. As a temporary mitigation, remove Camel control headers from inbound messages using `removeHeaders('Camel*')` and `removeHeaders('camel*')` at the start of the route. Require authentication on the WebSocket endpoint. Avoid bridging untrusted consumers directly to an HTTP producer where the target URI is determined by message headers.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.17.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x **Description** Improper input validation in the Iggy component allows an actor capable of publishing to the consumed Iggy stream or topic to inject Camel-internal control headers, such as `CamelHttpUri` (Exchange.HTTP URI), into the Camel Exchange header map. This occurs because the `IggyFetchRecords` function copies user-headers directly without applying a HeaderFilterStrategy. If the Iggy consumer feeds a downstream HTTP producer, the injected `CamelHttpUri` can redirect server-side HTTP requests to an attacker-chosen destination, resulting in Server-Side Request Forgery (SSRF). Furthermore, the HTTP producer resolves Camel property placeholders within the attacker-controlled URI, which can lead to the exposure of sensitive information, including environment variables, application properties, and vault secrets, as these are resolved to their real values and sent to the attacker. **Recommendations** Update Apache Camel versions 4.17.0 through 4.18.2 to version 4.18.3. Update Apache Camel versions 4.19.0 through 4.20.x to version 4.21.0. As a temporary mitigation, strip Camel control headers from inbound messages using `removeHeaders('Camel*')` and `removeHeaders('camel*')` at the start of the route. Restrict permissions for who can publish to the consumed Iggy stream or topic. Avoid bridging untrusted consumers directly into an HTTP producer where the target URI is driven by message headers.