CVE-2019-0194

Vulnerability

Description

CVE-2019-0194 is a directory traversal vulnerability in Apache Camel's File component. The root cause is that the component does not properly sanitize user-controlled filenames when writing files, allowing path traversal sequences (e.g., ../) to escape the intended starting directory [1][3]. This affects Camel versions 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0, and earlier unsupported 2.x releases (2.19 and prior) [1][3].

Exploitation

An attacker can exploit this by providing a crafted filename containing directory traversal payloads via a route that uses the File producer. No special authentication is required if the route is exposed to untrusted input. The attack surface is any Camel integration that accepts filenames from external sources (e.g., HTTP requests, message queues) and writes files to disk using the File component [2][4].

Impact

Successful exploitation allows an attacker to write files to arbitrary locations on the file system, outside the intended base directory. This could lead to overwriting sensitive files, deploying malicious scripts, or achieving code execution depending on the write permissions and the runtime environment [1][3].

Mitigation

Apache released patched versions: 2.21.5, 2.22.3, and 2.23.1 [3]. The fix introduces a new option to restrict file writes to the starting directory or its subdirectories by default, preventing path traversal [4]. Users are advised to upgrade immediately. No workarounds are documented for unpatched versions.