Summary
Apache Camel's dynamic-router-control endpoint may compile and evaluate an expression supplied through an incoming control message, allowing code or expression-language injection.
If an attacker can send messages through a transport forwarded to that endpoint, the expression may execute with the privileges of the Camel process without additional authentication or user interaction.
Apache Camel's dynamic-router-control endpoint may compile and evaluate an expression supplied through an incoming control message, allowing code or expression-language injection.
If an attacker can send messages through a transport forwarded to that endpoint, the expression may execute with the privileges of the Camel process without additional authentication or user interaction.
Affected context
The issue affects Apache Camel deployments using the dynamic-router-control endpoint introduced in the 4.4.0 release line and later affected release streams. Risk is present when a route forwards messages from an external, untrusted, or shared transport to the control endpoint and permits predicate or expression-language values from message bodies or headers. Deployments in which routing predicates are defined solely by the route author are less exposed to this specific condition.
The issue affects Apache Camel deployments using the dynamic-router-control endpoint introduced in the 4.4.0 release line and later affected release streams. Risk is present when a route forwards messages from an external, untrusted, or shared transport to the control endpoint and permits predicate or expression-language values from message bodies or headers. Deployments in which routing predicates are defined solely by the route author are less exposed to this specific condition.
Exploit preconditions
- Attack surface: A transport or message route that forwards input to a dynamic-router-control endpoint
- Required access: Ability to send a message on that transport; no separate authentication or user interaction is inherently required
- Trigger point: Processing of a subscription or update request containing a predicate or expression-language selection
- Why exploitation is possible: The endpoint accepts attacker-controlled expression data, resolves the requested language from the CamelContext, compiles the expression into a predicate, and evaluates it with Camel process privileges
- Attack surface: A transport or message route that forwards input to a dynamic-router-control endpoint
- Required access: Ability to send a message on that transport; no separate authentication or user interaction is inherently required
- Trigger point: Processing of a subscription or update request containing a predicate or expression-language selection
- Why exploitation is possible: The endpoint accepts attacker-controlled expression data, resolves the requested language from the CamelContext, compiles the expression into a predicate, and evaluates it with Camel process privileges
Why this happens
The underlying flaw is the failure to treat predicate expressions and expression-language selections in control messages as untrusted data. DynamicRouterControlService resolves and compiles values supplied through message fields or headers without an allow-list, explicit opt-in, or equivalent trust-boundary enforcement. This combines CWE-94: Improper Control of Generation of Code with CWE-917: Expression Language Injection, because attacker-influenced input is interpreted as executable expression logic rather than constrained to route-defined behavior.
The underlying flaw is the failure to treat predicate expressions and expression-language selections in control messages as untrusted data. DynamicRouterControlService resolves and compiles values supplied through message fields or headers without an allow-list, explicit opt-in, or equivalent trust-boundary enforcement. This combines CWE-94: Improper Control of Generation of Code with CWE-917: Expression Language Injection, because attacker-influenced input is interpreted as executable expression logic rather than constrained to route-defined behavior.
Potential impact
- An attacker may execute expressions with the privileges of the Camel process
- A vulnerable service could experience unauthorized data access or modification
- Routing behavior may be altered, causing message interception, redirection, or disruption
- Credentials, configuration data, or downstream services could be exposed
- The affected host or connected systems could be used for further compromise
- An attacker may execute expressions with the privileges of the Camel process
- A vulnerable service could experience unauthorized data access or modification
- Routing behavior may be altered, causing message interception, redirection, or disruption
- Credentials, configuration data, or downstream services could be exposed
- The affected host or connected systems could be used for further compromise
General mitigation guidance
Mitigation generally focuses on removing untrusted expression data from the dynamic-router control path and enforcing an explicit trust boundary.
Common defensive patterns include:
- Rejecting predicate and expression-language values supplied by control messages unless an explicit, tightly governed opt-in is required
- Defining subscription predicates and languages in trusted route configuration rather than accepting them from incoming messages
- Restricting which senders and transports can reach dynamic-router-control endpoints
- Authenticating and authorizing control-message producers when messages must cross external or shared transports
- Applying an allow-list for permitted expression languages and destination schemes
- Running Camel with least privilege and limiting access to sensitive downstream resources
- Treating removal of optional expression languages as insufficient because commonly available languages may still be exploitable
- Using maintained, supported software streams that contain the vendor's security fix
Mitigation generally focuses on removing untrusted expression data from the dynamic-router control path and enforcing an explicit trust boundary.
Common defensive patterns include:
- Rejecting predicate and expression-language values supplied by control messages unless an explicit, tightly governed opt-in is required
- Defining subscription predicates and languages in trusted route configuration rather than accepting them from incoming messages
- Restricting which senders and transports can reach dynamic-router-control endpoints
- Authenticating and authorizing control-message producers when messages must cross external or shared transports
- Applying an allow-list for permitted expression languages and destination schemes
- Running Camel with least privilege and limiting access to sensitive downstream resources
- Treating removal of optional expression languages as insufficient because commonly available languages may still be exploitable
- Using maintained, supported software streams that contain the vendor's security fix
How teams detect issues like this
Detection can include static analysis and configuration review for dynamic-router-control endpoints that consume predicate or expression-language values from message bodies or headers. Code review should flag routes that bridge untrusted transports to control endpoints, dynamically resolve expression languages, or enable permissive message-driven predicate handling. Runtime monitoring can look for unexpected control messages, unusual subscription changes, expression-language selections, and destinations outside approved schemes. Policy enforcement may require authenticated producers, explicit endpoint allow-lists, and security checks preventing untrusted message fields from reaching expression compilation APIs. Automated code and configuration review tools can help identify these patterns during development and deployment.
Detection can include static analysis and configuration review for dynamic-router-control endpoints that consume predicate or expression-language values from message bodies or headers. Code review should flag routes that bridge untrusted transports to control endpoints, dynamically resolve expression languages, or enable permissive message-driven predicate handling. Runtime monitoring can look for unexpected control messages, unusual subscription changes, expression-language selections, and destinations outside approved schemes. Policy enforcement may require authenticated producers, explicit endpoint allow-lists, and security checks preventing untrusted message fields from reaching expression compilation APIs. Automated code and configuration review tools can help identify these patterns during development and deployment.
Sources
| Source | Link |
|---|---|
| camel. | camel.apache.org/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| issues. | issues.apache.org/ |
