Authorization Bypass in Apache Camel Salesforce Component

Executive Summary

This vulnerability affects the Apache Camel camel-salesforce component and involves improper neutralization of special elements in output used by a downstream component, leading to an injection and authorization bypass issue.

Specifically, the component reads operation parameters such as SOQL queries, SOSL searches, target SObject names and IDs, Apex REST URLs and methods, and Apex query parameters from Exchange message headers. These headers use plain, non-Camel-prefixed names (e.g., sObjectQuery, apexUrl) that bypass HTTP header filtering.

Because these headers are not filtered, an attacker can send HTTP requests with specially crafted headers to override intended Salesforce operations. This allows unauthorized injection of SOQL/SOSL queries, modification of target SObjects for CRUD operations, or redirection of Apex REST calls, all executed with the full permissions of the connected Salesforce user.

No authentication is required from the attacker if the bridging HTTP consumer is unauthenticated, making it possible to exploit this vulnerability remotely.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data access and manipulation within your Salesforce environment.

• Attackers can inject malicious SOQL or SOSL queries to read sensitive data from any SObject accessible by the connected Salesforce user.
• They can override target SObject names and IDs to perform unauthorized create, read, update, or delete (CRUD) operations.
• Attackers can redirect Apex REST calls to different endpoints and HTTP methods, potentially executing destructive operations.

All these actions are performed with the full permissions of the connected Salesforce integration user, which typically has broad access, increasing the risk and impact.

If the HTTP consumer bridging to the salesforce producer is unauthenticated, no credentials are needed from the attacker, making exploitation easier.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to routes bridging an HTTP consumer (such as platform-http) into a salesforce: producer for the presence of non-Camel-prefixed Salesforce control headers like sObjectQuery, sObjectSearch, sObjectName, sObjectId, apexUrl, apexMethod, or apexQueryParam.* in the inbound HTTP requests.

Detection commands could include inspecting HTTP traffic or logs for these headers or using network monitoring tools to filter requests containing these header names.

• Use tools like tcpdump or Wireshark to capture HTTP traffic and filter for headers such as 'sObjectQuery' or 'apexUrl'.
• Use curl or similar HTTP clients to test endpoints by sending requests with these headers and observe if they are accepted or cause unexpected behavior.
• Check application logs or Camel route logs for unexpected Salesforce operation parameters being set from HTTP headers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Apache Camel to a fixed version: 4.14.8 for the 4.14.x LTS stream, 4.18.3 for the 4.18.x stream, or 4.21.0 or later for other versions.

If upgrading immediately is not possible, sanitize incoming HTTP requests by stripping Salesforce control headers with non-Camel-prefixed names before they reach the salesforce: producer.

• Remove headers matching 'sObject*' and 'apex*' at the start of the route using Camel's removeHeaders method.
• Set Salesforce operation parameters only from trusted sources rather than from raw HTTP headers.

After upgrading, update routes to use the new CamelSalesforce* header names (e.g., CamelSalesforceSObjectQuery) instead of the old sObject* or apex* headers to ensure proper HTTP header filtering.

Useful 0 Not Useful 0