Apache Camel issue on ExchangeCreatedEvent

Vulnerability

Overview

The Apache Camel EventFactory class is vulnerable to temporary file information disclosure. By crafting a malicious EventFactory and providing a custom ExchangeCreatedEvent, an attacker can expose sensitive data. [1][4] This issue affects Camel versions starting from 3.21.x through 3.21.3, 3.22.x through 3.22.0, 4.0.x through 4.0.3, and 4.x through 4.3.0. [1]

Exploitation

Prerequisites

Exploitation requires the ability to influence the EventFactory or the ExchangeCreatedEvent within a Camel integration. This could be achieved through untrusted inputs or by compromising a component that creates exchanges. No authentication is explicitly required beyond access to the Camel runtime. [4]

Impact

Successful exploitation results in the exposure of sensitive data that may be stored in temporary files or other transient storage, compromising confidentiality. [4]

Mitigation

Users are recommended to upgrade to the fixed versions: 3.21.4, 3.22.1, 4.0.4, or 4.4.0, depending on their release stream. [1][4] The issue is tracked in JIRA as CAMEL-20305. [2]