Executive Summary

The vulnerability exists in Apache Camel's Camel-PQC component, specifically in the FileBasedKeyLifecycleManager class. This class deserializes `<keyId>.key` files from a configured key directory using `java.io.ObjectInputStream` without applying any ObjectInputFilter or class-loading restrictions.

The deserialization process casts the deserialized object to `java.security.KeyPair` only after the `readObject()` method returns, which means any side effects in the deserialized object's `readObject()` method execute before the type check.

An attacker who can write to the key directory—through methods such as path traversal, misconfigured filesystem permissions, compromised key provisioning pipelines, or symlink attacks—can place a crafted serialized Java object. When this object is deserialized during normal key lifecycle operations, it can lead to arbitrary code execution within the application's context.

The issue affects Apache Camel versions from 4.19.0 before 4.20.0 and from 4.18.0 before 4.18.2. It is fixed by replacing the insecure deserialization mechanism with standard Base64-encoded JSON formats using PKCS#8 for private keys and X.509 SubjectPublicKeyInfo for public keys.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker who has write access to the key directory to execute arbitrary code within the context of the Apache Camel application.

Such arbitrary code execution can lead to full compromise of the application, potentially allowing the attacker to manipulate application behavior, access sensitive data, or disrupt services.

The attack vectors include path traversal, misconfigured filesystem permissions, compromised key provisioning pipelines, or symlink attacks that enable placing malicious serialized objects in the key directory.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, users should upgrade Apache Camel to version 4.20.0 or later.

For users on the 4.18.x LTS release stream, upgrading to version 4.18.2 is recommended.

These versions fix the issue by replacing the insecure java.io.ObjectInputStream-based key and metadata storage with standard Base64-encoded JSON formats using PKCS#8 for private keys and X.509 SubjectPublicKeyInfo for public keys.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows arbitrary code execution in the context of the Apache Camel application if an attacker can write to the key directory. This can lead to unauthorized access or manipulation of cryptographic keys used by the application.

Such unauthorized access or compromise of cryptographic keys can undermine the confidentiality and integrity of sensitive data, potentially violating data protection requirements under standards like GDPR and HIPAA.

Therefore, this vulnerability poses a risk to compliance with common security and privacy regulations that mandate protection of sensitive data and cryptographic materials.

Useful 0 Not Useful 0