Към съдържанието
Търсене

CVE-2026-78164: Apache Software Foundation Apache Camel, инжекция

8.2

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel HTTP producer families let an inbound message override the endpoint URI through the CamelHttpUri and CamelRestHttpUri headers, and then passed that message-supplied string through CamelContext.resolvePropertyPlaceholders() before using it. Property-placeholder resolution is a configuration-resolution facility, not a URI-parsing step: it reaches operating-system environment variables, JVM system properties, every PropertiesFunction registered on the classpath - including the secret functions - and, through camel-bean, the invocation of a no-argument method on any bean in the registry. Applying it to Exchange content therefore turned a URI string into a configuration- and bean-evaluation context. A route author opted into none of this: a plain static to("http://backend/api") was sufficient. Seven call sites were affected: HttpHelper.createURL and HttpHelper.createMethod in camel-http-common, HttpMethodHelper.createMethod in camel-http, VertxHttpHelper.resolveHttpURI in camel-vertx-http, UndertowHelper.createURL and UndertowHelper.createMethod in camel-undertow, and NettyHttpHelper.createURL in camel-netty-http. The bridgeEndpoint option did not bound the exposure: it suppresses the CamelHttpUri override in the createURL family but not in the createMethod family, so a route using the documented bridging configuration still resolved placeholders taken from the header, and CamelRestHttpUri was consumed before any bridgeEndpoint check in all four components. Only camel-http offered an opt-out, skipControlHeaders, which defaults to false. Reaching the headers did not always require header injection, because several Camel HTTP consumers populate CamelHttpUri f

Засегнати продукти

  • Apache Software Foundation Apache Camel: 4.0.0 преди 4.18.5; 4.19.0 преди 4.22.1; 4.18.5; 4.22.1; 4.23.0
  • Apache Software Foundation Apache Camel: 4.15.0 преди 4.18.5; 4.19.0 преди 4.22.1; 4.18.5; 4.22.1; 4.23.0
  • Apache Software Foundation Apache Camel: 4.15.0 преди 4.18.5; 4.19.0 преди 4.22.1; 4.18.5; 4.22.1; 4.23.0
  • Apache Software Foundation Apache Camel: 4.15.0 преди 4.18.5; 4.19.0 преди 4.22.1; 4.18.5; 4.22.1; 4.23.0
  • Apache Software Foundation Apache Camel: 4.15.0 преди 4.18.5; 4.19.0 преди 4.22.1; 4.18.5; 4.22.1; 4.23.0

Вид слабост

История

  • 19 октомври 2026 Публикувано

Други уязвимости в Apache Software Foundation Apache Camel

Първоизточници

CVE-2026-78164: Apache Software Foundation Apache Camel, инжекция | freedomonline.bg