Summary
Apache Camel's Saxon component may resolve XML external entities when an XQuery expression evaluates a stream-based javax.xml.transform.Source using the default Saxon configuration. An attacker who can supply XML through an affected route may be able to read files accessible to the Camel process or cause outbound requests to attacker-selected or internal hosts.
Apache Camel's Saxon component may resolve XML external entities when an XQuery expression evaluates a stream-based javax.xml.transform.Source using the default Saxon configuration. An attacker who can supply XML through an affected route may be able to read files accessible to the Camel process or cause outbound requests to attacker-selected or internal hosts.
Affected context
The issue occurs in Apache Camel's camel-saxon component when XQuery or the xquery language evaluates a message body that is already a stream-based javax.xml.transform.Source. This source can arise after route processing converts a body to Source or an earlier component assigns such a value. Other body types that pass through Camel's protected XML converters may not be affected, while risk remains when untrusted XML reaches Saxon without restrictive parser settings.
The issue occurs in Apache Camel's camel-saxon component when XQuery or the xquery language evaluates a message body that is already a stream-based javax.xml.transform.Source. This source can arise after route processing converts a body to Source or an earlier component assigns such a value. Other body types that pass through Camel's protected XML converters may not be affected, while risk remains when untrusted XML reaches Saxon without restrictive parser settings.
Exploit preconditions
- Attack surface: An Apache Camel route using the Saxon XQuery language or xquery component
- Required access: Ability to provide or influence XML content consumed by the route
- Trigger point: Evaluation of an already-created, stream-based
javax.xml.transform.Source - Configuration condition: The route uses a default or otherwise permissive Saxon Configuration
- Why exploitation is possible: The parser may accept a DOCTYPE declaration and resolve external entities or external DTDs before the XQuery expression processes the document
- Attack surface: An Apache Camel route using the Saxon XQuery language or xquery component
- Required access: Ability to provide or influence XML content consumed by the route
- Trigger point: Evaluation of an already-created, stream-based
javax.xml.transform.Source - Configuration condition: The route uses a default or otherwise permissive Saxon Configuration
- Why exploitation is possible: The parser may accept a DOCTYPE declaration and resolve external entities or external DTDs before the XQuery expression processes the document
Why this happens
The vulnerability results from inconsistent XML parser security configuration across message-processing paths. XQueryBuilder created the default Saxon Configuration with whitespace handling but did not explicitly reject DOCTYPE declarations or disable external entity and external DTD resolution. When a stream-based Source still required parsing, Saxon processed it with those permissive defaults, bypassing protections applied by Camel's other XML type converters. This behavior maps to CWE-611: Improper Restriction of XML External Entity Reference.
The vulnerability results from inconsistent XML parser security configuration across message-processing paths. XQueryBuilder created the default Saxon Configuration with whitespace handling but did not explicitly reject DOCTYPE declarations or disable external entity and external DTD resolution. When a stream-based Source still required parsing, Saxon processed it with those permissive defaults, bypassing protections applied by Camel's other XML type converters. This behavior maps to CWE-611: Improper Restriction of XML External Entity Reference.
Potential impact
- Sensitive local files readable by the Camel process may be disclosed
- The process may issue requests to internal, localhost, or attacker-controlled hosts
- Cloud metadata or other internal service information could be exposed
- Route confidentiality and downstream data processing could be compromised
- Network segmentation controls may be weakened through server-side request forgery
- Sensitive local files readable by the Camel process may be disclosed
- The process may issue requests to internal, localhost, or attacker-controlled hosts
- Cloud metadata or other internal service information could be exposed
- Route confidentiality and downstream data processing could be compromised
- Network segmentation controls may be weakened through server-side request forgery
General mitigation guidance
Mitigation generally focuses on enforcing secure XML parsing at every conversion and evaluation boundary.
Common defensive patterns include:
- Configure Saxon parsers to reject DOCTYPE declarations and disable external entities and external DTD loading
- Avoid evaluating XQuery over
Sourceobjects containing XML from untrusted senders unless secure parser settings are guaranteed - Prefer secure-by-default XML libraries and parser configurations
- Normalize and validate message types before handing them to XML or XQuery processors
- Reduce trust in route-provided and externally supplied XML content
- Run Camel processes with least-privilege filesystem and network permissions
- Apply outbound network restrictions to limit access to internal services and metadata endpoints
- Use supported maintenance releases that provide secure parser defaults, following organizational change-control procedures
Mitigation generally focuses on enforcing secure XML parsing at every conversion and evaluation boundary.
Common defensive patterns include:
- Configure Saxon parsers to reject DOCTYPE declarations and disable external entities and external DTD loading
- Avoid evaluating XQuery over
Sourceobjects containing XML from untrusted senders unless secure parser settings are guaranteed - Prefer secure-by-default XML libraries and parser configurations
- Normalize and validate message types before handing them to XML or XQuery processors
- Reduce trust in route-provided and externally supplied XML content
- Run Camel processes with least-privilege filesystem and network permissions
- Apply outbound network restrictions to limit access to internal services and metadata endpoints
- Use supported maintenance releases that provide secure parser defaults, following organizational change-control procedures
How teams detect issues like this
Detection can combine source analysis, route review, and runtime controls:
- Search for Saxon or XML parser configurations that omit restrictions on DOCTYPE, external entities, or external DTD loading
- Review routes that call
convertBodyTo(Source.class)or assign stream-basedSourceobjects before XQuery evaluation - Identify XQuery endpoints receiving XML from external or otherwise untrusted producers
- Add static-analysis and dependency-policy rules for unsafe XML parser defaults
- Monitor unexpected outbound requests and file access from Camel worker processes
- Use automated security review tools to flag XML parsing paths where parser protections are not explicit
Detection can combine source analysis, route review, and runtime controls:
- Search for Saxon or XML parser configurations that omit restrictions on DOCTYPE, external entities, or external DTD loading
- Review routes that call
convertBodyTo(Source.class)or assign stream-basedSourceobjects before XQuery evaluation - Identify XQuery endpoints receiving XML from external or otherwise untrusted producers
- Add static-analysis and dependency-policy rules for unsafe XML parser defaults
- Monitor unexpected outbound requests and file access from Camel worker processes
- Use automated security review tools to flag XML parsing paths where parser protections are not explicit
Sources
| Source | Link |
|---|---|
| camel. | camel.apache.org/ |
| camel. | camel.apache.org/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| issues. | issues.apache.org/ |
