Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.14.7, 4.18.2, 4.20.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel application could achieve remote code execution when a deserialization gadget chain was present on the classpath. The same handling was reached transitively through camel-sjms2 (whose Sjms2Endpoint extends SjmsEndpoint) and through camel-amqp (whose AMQPJmsBinding extends JmsBinding), and by other JMS-family components built on JmsComponent such as camel-activemq and camel-activemq6. This issue affects Apache Camel: from 3.0.0 before 4.14.7, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.7. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.2.
Timeline
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- CVE published
- Record last updated
Affected versions
- org.apache.camel:camel-jms
From 3.0.0 · fixed in 4.14.7; From 4.15.0 · fixed in 4.18.2; From 4.19.0 · fixed in 4.20.0
- org.apache.camel:camel-jmsMaven
From 3.0.0 · fixed in 4.14.7
- org.apache.camel:camel-jmsMaven
From 4.15.0 · fixed in 4.18.2
- org.apache.camel:camel-jmsMaven
From 4.19.0 · fixed in 4.20.0
- org.apache.camel:camel-sjmsMaven
From 3.0.0 · fixed in 4.14.7
- org.apache.camel:camel-sjmsMaven
From 4.15.0 · fixed in 4.18.2
- org.apache.camel:camel-sjmsMaven
From 4.19.0 · fixed in 4.20.0
- org.apache.camel:camel-sjms2Maven
From 3.0.0 · fixed in 4.14.7
- org.apache.camel:camel-sjms2Maven
From 4.15.0 · fixed in 4.18.2
- org.apache.camel:camel-sjms2Maven
From 4.19.0 · fixed in 4.20.0
- org.apache.camel:camel-amqpMaven
From 3.0.0 · fixed in 4.14.7
- org.apache.camel:camel-amqpMaven
From 4.15.0 · fixed in 4.18.2
- org.apache.camel:camel-amqpMaven
From 4.19.0 · fixed in 4.20.0
- org.apache.camel:camel-activemqMaven
From 3.0.0 · fixed in 4.14.7
- org.apache.camel:camel-activemqMaven
From 4.15.0 · fixed in 4.18.2
- org.apache.camel:camel-activemqMaven
From 4.19.0 · fixed in 4.20.0
- org.apache.camel:camel-activemq6Maven
From 3.0.0 · fixed in 4.14.7
- org.apache.camel:camel-activemq6Maven
From 4.15.0 · fixed in 4.18.2
- org.apache.camel:camel-activemq6Maven
From 4.19.0 · fixed in 4.20.0