Summary
Apache Camel's XPath component could resolve external XML entities when an expression used the InputSource document type, bypassing parser hardening applied to the default type.
If untrusted XML reaches such an expression, an external sender may read files accessible to the Camel process or cause outbound requests to attacker-selected hosts.
Apache Camel's XPath component could resolve external XML entities when an expression used the InputSource document type, bypassing parser hardening applied to the default type.
If untrusted XML reaches such an expression, an external sender may read files accessible to the Camel process or cause outbound requests to attacker-selected hosts.
Affected context
The vulnerability affects Apache Camel XPath expressions that:
- Use the InputSource document type
- Process XML supplied or influenced by an external sender
- Rely on the component's parser configuration without separately restricting external entities
The risk is increased when deployments configure parser-related system properties that relax the hardened defaults.
The vulnerability affects Apache Camel XPath expressions that:
- Use the InputSource document type
- Process XML supplied or influenced by an external sender
- Rely on the component's parser configuration without separately restricting external entities
The risk is increased when deployments configure parser-related system properties that relax the hardened defaults.
Exploit preconditions
- Attack surface: An externally reachable or indirectly supplied XML input processed by the Apache Camel XPath component
- Required access: Ability to send or influence XML evaluated by a vulnerable XPath expression
- Trigger point: XML parsing and XPath evaluation using the InputSource document type
- Why exploitation is possible: The selected document type may construct a parser with weaker external-entity restrictions, allowing a supplied DOCTYPE declaration to resolve external entities
- Attack surface: An externally reachable or indirectly supplied XML input processed by the Apache Camel XPath component
- Required access: Ability to send or influence XML evaluated by a vulnerable XPath expression
- Trigger point: XML parsing and XPath evaluation using the InputSource document type
- Why exploitation is possible: The selected document type may construct a parser with weaker external-entity restrictions, allowing a supplied DOCTYPE declaration to resolve external entities
Why this happens
The root cause is inconsistent security configuration between Apache Camel's default XML document type and its InputSource document type.
When InputSource content was passed to a JDK XPath parser that created its own DocumentBuilder using default settings, the parser did not inherit the hardening applied elsewhere. Consequently, external entity references could be accepted and expanded. This maps to CWE-611: Improper Restriction of XML External Entity Reference.
The root cause is inconsistent security configuration between Apache Camel's default XML document type and its InputSource document type.
When InputSource content was passed to a JDK XPath parser that created its own DocumentBuilder using default settings, the parser did not inherit the hardening applied elsewhere. Consequently, external entity references could be accepted and expanded. This maps to CWE-611: Improper Restriction of XML External Entity Reference.
Potential impact
- An attacker may read local files accessible to the Camel process
- The application may issue requests to attacker-selected internal or external hosts
- Internal services or metadata endpoints could be exposed through server-side request forgery
- Sensitive XML-processing results or application data could be disclosed
- Network segmentation and trust boundaries may be weakened
- An attacker may read local files accessible to the Camel process
- The application may issue requests to attacker-selected internal or external hosts
- Internal services or metadata endpoints could be exposed through server-side request forgery
- Sensitive XML-processing results or application data could be disclosed
- Network segmentation and trust boundaries may be weakened
General mitigation guidance
Mitigation centers on ensuring that every XML parsing path uses consistent, secure-by-default configuration.
Common defensive patterns include:
- Route InputSource processing through the same hardened parser configuration as other document types
- Reject DOCTYPE declarations and disable external general and parameter entities
- Disable external schema, DTD, and stylesheet access unless explicitly required
- Avoid using InputSource for untrusted XML when a securely configured alternative is available
- Treat parser-relaxing system properties as controlled security exceptions and audit their use
- Apply least privilege to the Camel process and restrict unnecessary outbound network access
- Validate and constrain XML inputs before XPath evaluation
Mitigation centers on ensuring that every XML parsing path uses consistent, secure-by-default configuration.
Common defensive patterns include:
- Route InputSource processing through the same hardened parser configuration as other document types
- Reject DOCTYPE declarations and disable external general and parameter entities
- Disable external schema, DTD, and stylesheet access unless explicitly required
- Avoid using InputSource for untrusted XML when a securely configured alternative is available
- Treat parser-relaxing system properties as controlled security exceptions and audit their use
- Apply least privilege to the Camel process and restrict unnecessary outbound network access
- Validate and constrain XML inputs before XPath evaluation
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis rules identifying XML parsers without secure entity and DTD settings
- Code review checks for document-type-specific parser construction or configuration drift
- Configuration scans for parser-relaxing system properties
- Tests that verify DOCTYPE and external entity inputs are rejected across every supported document type
- Network monitoring for unexpected outbound requests from Camel services
- File-access monitoring for suspicious reads by the application process
Automated security review tools can help identify inconsistent XML parser hardening during development.
Organizations can detect this class of issue through:
- Static analysis rules identifying XML parsers without secure entity and DTD settings
- Code review checks for document-type-specific parser construction or configuration drift
- Configuration scans for parser-relaxing system properties
- Tests that verify DOCTYPE and external entity inputs are rejected across every supported document type
- Network monitoring for unexpected outbound requests from Camel services
- File-access monitoring for suspicious reads by the application process
Automated security review tools can help identify inconsistent XML parser hardening during development.
Sources
| Source | Link |
|---|---|
| camel. | camel.apache.org/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| issues. | issues.apache.org/ |
