Summary
Apache Camel's Spring Redis component may deserialize untrusted Redis message and key-value data with Java's native serialization when no safer serializer is configured. An actor who can publish to a subscribed Redis channel or influence relevant Redis values may trigger arbitrary class instantiation and code execution before route logic can inspect the data.
Apache Camel's Spring Redis component may deserialize untrusted Redis message and key-value data with Java's native serialization when no safer serializer is configured. An actor who can publish to a subscribed Redis channel or influence relevant Redis values may trigger arbitrary class instantiation and code execution before route logic can inspect the data.
Affected context
The issue can occur in Apache Camel deployments using the Spring Redis component when the serializer option is left unset. In that configuration, consumer message bodies and certain Redis operations may use a lazily created JDK serialization serializer without an object input filter. A custom serializer configured only on a Redis template may not protect the consumer path if the endpoint-level serializer remains unchanged.
The issue can occur in Apache Camel deployments using the Spring Redis component when the serializer option is left unset. In that configuration, consumer message bodies and certain Redis operations may use a lazily created JDK serialization serializer without an object input filter. A custom serializer configured only on a Redis template may not protect the consumer path if the endpoint-level serializer remains unchanged.
Exploit preconditions
- Attack surface: Redis channels and keyspace data consumed by the Camel Spring Redis component
- Required access: Ability to publish messages to a subscribed channel or influence serialized values read by the component
- Trigger point: Redis consumer message handling or Redis-backed reads such as GET, HGET, HGETALL, and HVALS
- Why exploitation is possible: Untrusted bytes are passed to Java deserialization without a restrictive object input filter, allowing attacker-controlled class graphs to be materialized before route processing
- Attack surface: Redis channels and keyspace data consumed by the Camel Spring Redis component
- Required access: Ability to publish messages to a subscribed channel or influence serialized values read by the component
- Trigger point: Redis consumer message handling or Redis-backed reads such as GET, HGET, HGETALL, and HVALS
- Why exploitation is possible: Untrusted bytes are passed to Java deserialization without a restrictive object input filter, allowing attacker-controlled class graphs to be materialized before route processing
Why this happens
The component lazily selects a bare JDK serialization serializer when no explicit serializer is configured. Spring's deserialization path then reads attacker-influenced bytes through an object input stream without an appropriate java.io.ObjectInputFilter, allowing serialized classes and their deserialization callbacks to execute.
This behavior maps to CWE-502: Deserialization of Untrusted Data because external data is treated as a trusted serialized object graph rather than as constrained application data.
The component lazily selects a bare JDK serialization serializer when no explicit serializer is configured. Spring's deserialization path then reads attacker-influenced bytes through an object input stream without an appropriate java.io.ObjectInputFilter, allowing serialized classes and their deserialization callbacks to execute.
This behavior maps to CWE-502: Deserialization of Untrusted Data because external data is treated as a trusted serialized object graph rather than as constrained application data.
Potential impact
- An attacker may execute code in the Camel process
- The application process could be compromised
- Route credentials, secrets, or connected services may be exposed
- Redis-backed application state could be altered or poisoned
- The host or surrounding services may be used for lateral movement
- An attacker may execute code in the Camel process
- The application process could be compromised
- Route credentials, secrets, or connected services may be exposed
- Redis-backed application state could be altered or poisoned
- The host or surrounding services may be used for lateral movement
General mitigation guidance
Mitigation generally focuses on removing Java native serialization from Redis data paths and reducing trust in Redis-controlled input.
Common defensive patterns include:
- Configure an endpoint-level serializer that uses a constrained data format, such as a string or explicitly allowlisted representation
- Ensure consumer serializer settings are configured directly rather than relying only on a custom Redis template
- Apply a restrictive JVM-wide serialization filter as defense in depth where Java serialization cannot yet be removed
- Require Redis authentication and limit which clients can publish to subscribed channels
- Keep Redis instances on protected networks and prevent exposure to untrusted clients
- Run Camel with least-privilege operating-system, container, and service permissions
- Prefer supported component releases that contain the security fix as part of normal dependency maintenance
Mitigation generally focuses on removing Java native serialization from Redis data paths and reducing trust in Redis-controlled input.
Common defensive patterns include:
- Configure an endpoint-level serializer that uses a constrained data format, such as a string or explicitly allowlisted representation
- Ensure consumer serializer settings are configured directly rather than relying only on a custom Redis template
- Apply a restrictive JVM-wide serialization filter as defense in depth where Java serialization cannot yet be removed
- Require Redis authentication and limit which clients can publish to subscribed channels
- Keep Redis instances on protected networks and prevent exposure to untrusted clients
- Run Camel with least-privilege operating-system, container, and service permissions
- Prefer supported component releases that contain the security fix as part of normal dependency maintenance
How teams detect issues like this
Detection can include static analysis for default construction or use of JdkSerializationRedisSerializer, Java serialization APIs, and deserialization paths lacking object input filters. Code review should examine whether endpoint-level serializers are explicitly configured and whether custom Redis templates leave separate consumer paths unprotected.
Runtime monitoring can alert on unexpected Redis publishers, unusual channel activity, deserialization errors, and outbound behavior from Camel processes. CI policy checks may require approved serializers, restrictive serialization filters, authenticated Redis connections, and automated dependency security review.
Detection can include static analysis for default construction or use of JdkSerializationRedisSerializer, Java serialization APIs, and deserialization paths lacking object input filters. Code review should examine whether endpoint-level serializers are explicitly configured and whether custom Redis templates leave separate consumer paths unprotected.
Runtime monitoring can alert on unexpected Redis publishers, unusual channel activity, deserialization errors, and outbound behavior from Camel processes. CI policy checks may require approved serializers, restrictive serialization filters, authenticated Redis connections, and automated dependency security review.
Sources
| Source | Link |
|---|---|
| camel. | camel.apache.org/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| issues. | issues.apache.org/ |
| github. | github.com/ |
