Apache Camel JIRA: Temporary file information disclosure in Camel-Jira

Apache Camel before versions 3.14.9, 3.18.8, 3.20.6, 3.21.0, and 4.0.0-M1 contains an information exposure vulnerability in the FileConverter utility of the camel-jira component [1]. The bug lies in the genericToFile method, which wrote byte array content to a file in the system temporary directory using new File(destDir, genericFile.getFileName()) without proper sanitization [4]. This allowed an attacker who could control the GenericFile filename (e.g., via a JIRA attachment) to create a file at a predictable or attacker-specified location, potentially revealing the temporary path structure or overwriting files [2].

The attack requires the attacker to send a crafted message to a Camel route that uses the Jira component and triggers a file conversion (e.g., processing an attachment). No authentication is required beyond access to the messaging endpoint [1]. The insecure file creation could lead to a path traversal scenario if the filename contains directory traversal sequences, although the code attempted a jail check (getCanonicalPath().startsWith(destDir)) which could be bypassed in some environments [4]. The file was also marked for deletion on JVM exit, but not immediately after use, creating a race condition [2, 4].

A successful exploit could allow an unauthenticated actor to obtain the system's temporary directory path, or in worst-case scenarios, write files to arbitrary locations if the jail check is bypassed, leading to local information disclosure or potential code execution in limited contexts [1]. The vulnerability is rated as information exposure to an unauthorized actor.

The fix involves using Files.createTempFile(prefix, suffix, attrs) to generate a secure, randomized temporary filename and immediately writing content, then scheduling deletion on exit [4]. Users must upgrade to the fixed versions: 3.14.9, 3.18.8, 3.20.6, 3.21.0, or 4.0.0-M1 [1]. Affected versions include 3.X through 3.14.8, 3.18.X through 3.18.7, 3.20.X through 3.20.5, and 4.X through 4.0.0-M3 [1].