Mark Thorson

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.8.0 through 4.8.5 Apache Camel versions 4.10.0 through 4.10.2 **Description** The issue is related to a Bypass/Injection vulnerability in the Apache Camel-Undertow component. This vulnerability allows an attacker to include Camel specific headers that can alter the behavior of some Camel components, such as the camel-bean component or the camel-exec component. The custom header filter strategy used by the component only filters the "out" direction, while it doesn't filter the "in" direction. **Recommendations** For Apache Camel versions 4.8.0 through 4.8.5, upgrade to version 4.8.6. For Apache Camel versions 4.10.0 through 4.10.2, upgrade to version 4.10.3. As a temporary workaround, consider restricting the use of the vulnerable Camel-Undertow component until a patch is available. Avoid using the custom header filter strategy in the "in" direction to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.10.0 through 4.10.2 Apache Camel versions 4.8.0 through 4.8.5 Apache Camel versions 3.10.0 through 3.22.3 **Description** A bypass and injection issue exists in the default incoming header filter of Apache Camel. The filter performs case-sensitive checks for strings like "Camel", "camel", and "org.apache.camel", but the headers are applied without case sensitivity. This allows a remote attacker to bypass the filter by using mixed-case headers (e.g., `CAmelExecCommandExecutable`) to execute internal Camel methods or alter the behavior of specific components such as `camel-bean` and `camel-exec`. For applications connected to the internet via HTTP, attackers can inject these headers through HTTP request parameters or the request payload. The following HTTP components are vulnerable by default: `camel-servlet`, `camel-jetty`, `camel-undertow`, `camel-platform-http`, and `camel-netty-http`. Real-world exploitation has been observed, with over 126,000 attack attempts blocked by security vendors in March alone. **Recommendations** Update Apache Camel version 4.10.x LTS to 4.10.2. Update Apache Camel version 4.8.x LTS to 4.8.5. Update Apache Camel version 3.x to 3.22.4.

**Name of the Vulnerable Software and Affected Versions** Apache Camel versions 4.10.0 through 4.10.1 Apache Camel versions 4.8.0 through 4.8.4 Apache Camel versions 3.10.0 through 3.22.3 **Description** A bypass and injection issue exists in the default incoming header filter of Apache Camel due to case-sensitive filtering. The mechanism only blocks headers starting with "Camel", "camel", or "org.apache.camel.", allowing attackers to bypass these filters using mixed-case headers (e.g., `cAmel`) or HTTP request parameters. This can lead to remote code execution (RCE) by altering the behavior of specific components. For example, in the `camel-bean` component, an attacker can invoke methods other than those intended by the application. In the `camel-jms` component, malicious headers can redirect messages to different queues on the same broker. The `camel-exec` component is also susceptible to command overwriting. This issue is particularly critical for applications directly exposed to the internet via HTTP components such as `camel-servlet`, `camel-jetty`, `camel-undertow`, `camel-platform-http`, and `camel-netty-http`. Thousands of scans and attack attempts have been recorded in the wild, especially within cloud-native environments like Kubernetes clusters. **Recommendations** Upgrade Apache Camel version 4.10.x LTS to 4.10.2. Upgrade Apache Camel version 4.8.x LTS to 4.8.5. Upgrade Apache Camel version 3.x to 3.22.4. As a temporary workaround, use the `removeHeaders` EIP to filter out headers that do not strictly start with "Camel", "camel", or "org.apache.camel.".