Leon Zlobecki

**Name of the Vulnerable Software and Affected Versions** RESTEasy (affected versions not specified) **Description** A flaw in the `SourceProvider` allows an unauthenticated attacker to perform a remote file read. By sending a specially crafted XML body containing a DOCTYPE declaration that references external entities to an endpoint accepting `application/xml` and returning `Source` or `StreamSource`, the server may resolve the entity and include sensitive file contents in the HTTP response. This occurs because the `writeTo()` function creates a SAXParser without disabling external entity resolution, resulting in an XML External Entity (XXE) vulnerability—a type of attack that interferes with an application's processing of XML data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.12.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x **Description** An improper input validation issue exists in the Apache Camel DAPR component, specifically within the `DaprPubSubConsumer`. The component copies the Pub/Sub component name and topic from inbound CloudEvents into the `CamelDaprPubSubName` and `CamelDaprTopic` Exchange headers. Because the `DaprConfigurationOptionsProxy` prioritizes these headers over the configured destination during republishing, an attacker capable of publishing messages to a subscribed topic can manipulate these values. This allows the attacker to redirect or exfiltrate messages to an arbitrary Dapr Pub/Sub component and topic, bypassing intended routing and topic-level access controls. Exploitation requires the ability to publish to the topic the route subscribes to. **Recommendations** Upgrade to version 4.21.0. Upgrade to version 4.14.8 for those on the 4.14.x LTS releases stream. Upgrade to version 4.18.3 for those on the 4.18.x releases stream. As a temporary mitigation, remove the `CamelDaprPubSubName` and `CamelDaprTopic` headers from the Exchange between the Dapr consumer and any Dapr producer in the route. Restrict publishing permissions for the subscribed Dapr Pub/Sub topic to trusted producers only.