Summary
An XML External Entity (XXE) vulnerability in Apache Camel's Smooks component allows attacker-controlled XML bodies to reference external entities. When those bodies are unmarshalled with the default XML reader, an attacker may read files accessible to the Camel process or cause requests to internal network locations.
An XML External Entity (XXE) vulnerability in Apache Camel's Smooks component allows attacker-controlled XML bodies to reference external entities. When those bodies are unmarshalled with the default XML reader, an attacker may read files accessible to the Camel process or cause requests to internal network locations.
Affected context
The issue occurs in Apache Camel deployments using the camel-smooks component or Smooks data format to unmarshal XML messages with the default reader. It becomes risky when untrusted XML can reach the Smooks endpoint or route and the underlying parser permits external general entities, parameter entities, or external DTDs. Configurations that explicitly use EDI, CSV, JSON, or custom readers are generally outside this XML parsing path.
The issue occurs in Apache Camel deployments using the camel-smooks component or Smooks data format to unmarshal XML messages with the default reader. It becomes risky when untrusted XML can reach the Smooks endpoint or route and the underlying parser permits external general entities, parameter entities, or external DTDs. Configurations that explicitly use EDI, CSV, JSON, or custom readers are generally outside this XML parsing path.
Exploit preconditions
- Attack surface: A Camel route, endpoint, or data format using camel-smooks to process XML
- Required access: Ability to submit or influence an XML message body accepted by that route
- Trigger point: XML unmarshalling through the default Smooks reader
- Why exploitation is possible: External entity and DTD resolution remains enabled, allowing references in the XML document to be resolved by the Camel process
- Attack surface: A Camel route, endpoint, or data format using camel-smooks to process XML
- Required access: Ability to submit or influence an XML message body accepted by that route
- Trigger point: XML unmarshalling through the default Smooks reader
- Why exploitation is possible: External entity and DTD resolution remains enabled, allowing references in the XML document to be resolved by the Camel process
Why this happens
The vulnerability results from insufficient hardening of the XML parser used by the Smooks component. External general entities, parameter entities, and external DTDs are resolved during parsing, causing attacker-controlled XML declarations to be treated as references to local files or network resources. This behavior maps to CWE-611: Improper Restriction of XML External Entity Reference, where XML processing does not adequately disable external resource resolution for untrusted input.
The vulnerability results from insufficient hardening of the XML parser used by the Smooks component. External general entities, parameter entities, and external DTDs are resolved during parsing, causing attacker-controlled XML declarations to be treated as references to local files or network resources. This behavior maps to CWE-611: Improper Restriction of XML External Entity Reference, where XML processing does not adequately disable external resource resolution for untrusted input.
Potential impact
- An attacker may read files accessible to the Camel process
- The application could disclose sensitive configuration, credentials, or operational data
- The Camel process may issue requests to internal or otherwise restricted network locations
- Server-side request forgery could enable internal service discovery or interaction
- Returned entity content could affect downstream message processing or data handling
- An attacker may read files accessible to the Camel process
- The application could disclose sensitive configuration, credentials, or operational data
- The Camel process may issue requests to internal or otherwise restricted network locations
- Server-side request forgery could enable internal service discovery or interaction
- Returned entity content could affect downstream message processing or data handling
General mitigation guidance
Mitigation generally focuses on disabling external XML resource resolution for untrusted messages and reducing parser trust in document-supplied entities.
Common defensive patterns include:
- Use XML parsers configured to disable external general entities, parameter entities, and external DTD loading by default
- Prefer secure, namespace-aware parser configurations and explicitly restrict permitted XML features
- Avoid enabling external entity resolution unless a narrowly controlled legacy workflow requires it
- Separate trusted and untrusted XML processing paths and apply security policies to each
- Limit the Camel process's filesystem permissions and outbound network access
- Use a maintained Apache Camel release containing the parser-hardening fix
- Validate message formats and enforce route-level authorization before XML reaches Smooks
Mitigation generally focuses on disabling external XML resource resolution for untrusted messages and reducing parser trust in document-supplied entities.
Common defensive patterns include:
- Use XML parsers configured to disable external general entities, parameter entities, and external DTD loading by default
- Prefer secure, namespace-aware parser configurations and explicitly restrict permitted XML features
- Avoid enabling external entity resolution unless a narrowly controlled legacy workflow requires it
- Separate trusted and untrusted XML processing paths and apply security policies to each
- Limit the Camel process's filesystem permissions and outbound network access
- Use a maintained Apache Camel release containing the parser-hardening fix
- Validate message formats and enforce route-level authorization before XML reaches Smooks
How teams detect issues like this
Detection can include:
- Static analysis for XML parser configurations that enable external entities or external DTDs
- Code and configuration review of camel-smooks routes, Smooks data formats, and custom reader settings
- Tests using benign external-entity and external-DTD indicators to verify that resolution is blocked
- Network monitoring for unexpected outbound requests from Camel services during XML processing
- File-access monitoring for reads of sensitive paths by Camel application processes
- Policy enforcement requiring secure XML parser settings and disallowing untrusted XML in routes without explicit review
Automated security scanners and code-review tools may help identify unsafe XML parsing patterns.
Detection can include:
- Static analysis for XML parser configurations that enable external entities or external DTDs
- Code and configuration review of camel-smooks routes, Smooks data formats, and custom reader settings
- Tests using benign external-entity and external-DTD indicators to verify that resolution is blocked
- Network monitoring for unexpected outbound requests from Camel services during XML processing
- File-access monitoring for reads of sensitive paths by Camel application processes
- Policy enforcement requiring secure XML parser settings and disallowing untrusted XML in routes without explicit review
Automated security scanners and code-review tools may help identify unsafe XML parsing patterns.
Sources
| Source | Link |
|---|---|
| camel. | camel.apache.org/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| issues. | issues.apache.org/ |
