Summary
Apache Camel's HTTP component may forward bearer tokens, basic credentials, or digest credentials to an unintended host when automatic redirects are enabled. An attacker who controls a remote endpoint or can influence its responses could redirect a request to a host under their control and collect the credentials.
Apache Camel's HTTP component may forward bearer tokens, basic credentials, or digest credentials to an unintended host when automatic redirects are enabled. An attacker who controls a remote endpoint or can influence its responses could redirect a request to a host under their control and collect the credentials.
Affected context
The issue occurs in Apache Camel HTTP component deployments that:
- Use versions within the affected 4.x release ranges
- Send OAuth2 bearer tokens or basic/digest credentials
- Enable automatic redirect following through
followRedirects=true - Permit a remote endpoint to return redirects that change the destination host
The risk is present when client authentication state is reused across redirect
hops without restricting it to the originally configured authority.
The issue occurs in Apache Camel HTTP component deployments that:
- Use versions within the affected 4.x release ranges
- Send OAuth2 bearer tokens or basic/digest credentials
- Enable automatic redirect following through
followRedirects=true - Permit a remote endpoint to return redirects that change the destination host
The risk is present when client authentication state is reused across redirect
hops without restricting it to the originally configured authority.
Exploit preconditions
- Attack surface: Outbound HTTP requests made by Apache Camel routes
- Required access: Ability to operate or influence the remote endpoint's HTTP responses
- Trigger point: A redirect response that sends the client to an attacker-controlled host
- Required configuration: Credentials are attached to the request and automatic redirect following is enabled
- Why exploitation is possible: Request interceptors and broadly scoped authentication credentials are applied again after the destination changes
- Attack surface: Outbound HTTP requests made by Apache Camel routes
- Required access: Ability to operate or influence the remote endpoint's HTTP responses
- Trigger point: A redirect response that sends the client to an attacker-controlled host
- Required configuration: Credentials are attached to the request and automatic redirect following is enabled
- Why exploitation is possible: Request interceptors and broadly scoped authentication credentials are applied again after the destination changes
Why this happens
The vulnerability results from authentication state being reused across HTTP
redirect boundaries without verifying that the destination authority remains the
one configured by the route.
OAuth2 request interception occurred at a protocol-processing layer that ran
again for each redirect hop, causing the bearer token to be re-attached to the
new host. Separately, authentication credentials registered for an overly broad
host scope could also be presented to redirect targets. This behavior maps to
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor because
confidential authentication material can be disclosed to an unintended recipient.
The vulnerability results from authentication state being reused across HTTP
redirect boundaries without verifying that the destination authority remains the
one configured by the route.
OAuth2 request interception occurred at a protocol-processing layer that ran
again for each redirect hop, causing the bearer token to be re-attached to the
new host. Separately, authentication credentials registered for an overly broad
host scope could also be presented to redirect targets. This behavior maps to
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor because
confidential authentication material can be disclosed to an unintended recipient.
Potential impact
- An attacker may capture OAuth2 bearer tokens
- Configured basic or digest credentials could be disclosed
- Exposed tokens may allow unauthorized access to downstream services
- Compromised credentials could enable impersonation or lateral movement
- Sensitive data returned by authenticated services may be accessed
- An attacker may capture OAuth2 bearer tokens
- Configured basic or digest credentials could be disclosed
- Exposed tokens may allow unauthorized access to downstream services
- Compromised credentials could enable impersonation or lateral movement
- Sensitive data returned by authenticated services may be accessed
General mitigation guidance
Mitigation should enforce destination-aware credential handling and reduce trust
in redirect destinations.
Common defensive patterns include:
- Restricting credentials to the exact authority configured by the route
- Preventing authentication headers and credential state from crossing host boundaries
- Disabling automatic redirects for requests that carry credentials
- Handling redirects explicitly so the route determines and validates the destination
- Applying least privilege and short lifetimes to tokens and service credentials
- Avoiding broadly scoped authentication registrations
- Monitoring and limiting outbound connections from credential-bearing services
Mitigation should enforce destination-aware credential handling and reduce trust
in redirect destinations.
Common defensive patterns include:
- Restricting credentials to the exact authority configured by the route
- Preventing authentication headers and credential state from crossing host boundaries
- Disabling automatic redirects for requests that carry credentials
- Handling redirects explicitly so the route determines and validates the destination
- Applying least privilege and short lifetimes to tokens and service credentials
- Avoiding broadly scoped authentication registrations
- Monitoring and limiting outbound connections from credential-bearing services
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis of redirect handlers and HTTP client authentication configuration
- Code review checks for credential reuse after changes to host, scheme, or port
- Searches for unrestricted authentication scopes or interceptors that run on every request
- Tests that verify credentials are removed when a redirect crosses authorities
- Network monitoring for authenticated requests sent to unexpected destinations
- Policy enforcement requiring explicit redirect handling for credential-bearing requests
Automated code review and dependency analysis tools may help identify risky
redirect and authentication patterns, but runtime testing should also validate
destination isolation.
Organizations can look for this weakness through:
- Static analysis of redirect handlers and HTTP client authentication configuration
- Code review checks for credential reuse after changes to host, scheme, or port
- Searches for unrestricted authentication scopes or interceptors that run on every request
- Tests that verify credentials are removed when a redirect crosses authorities
- Network monitoring for authenticated requests sent to unexpected destinations
- Policy enforcement requiring explicit redirect handling for credential-bearing requests
Automated code review and dependency analysis tools may help identify risky
redirect and authentication patterns, but runtime testing should also validate
destination isolation.
Sources
| Source | Link |
|---|---|
| camel. | camel.apache.org/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| issues. | issues.apache.org/ |
