Server-Side Request Forgery in Apache Camel Iggy Component

Executive Summary

This vulnerability exists in the Apache Camel camel-iggy component where user-headers from inbound Iggy messages are mapped directly into the Camel Exchange header map without filtering. An attacker who can publish to the Iggy stream or topic can inject Camel control headers, such as CamelHttpUri, by supplying them as message user-headers.

When the Iggy consumer is connected to a downstream HTTP producer, the injected CamelHttpUri causes the server-side HTTP request to be redirected to an attacker-chosen destination, resulting in a Server-Side Request Forgery (SSRF).

Additionally, the HTTP producer resolves property placeholders embedded in the injected URI, which can expose sensitive information such as environment variables, application properties, and vault secrets to the attacker.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized redirection of server-side HTTP requests to attacker-controlled destinations, potentially allowing attackers to access internal services or cloud metadata endpoints.

It can also lead to exposure of sensitive information such as environment variables, application properties, and vault secrets because the HTTP producer resolves placeholders in the attacker-injected URI and sends the resolved values to the attacker.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring the Iggy stream or topic for messages containing Camel control headers such as CamelHttpUri or other headers starting with Camel* or camel* that should not be present from untrusted sources.

You can inspect messages published to the Iggy stream/topic to identify if any user-headers include Camel control headers that could be injected into the Camel Exchange.

While specific commands are not provided in the available resources, a general approach would be to use logging or message inspection tools to filter or search for headers matching the pattern 'Camel*' or 'camel*' in the inbound messages.

• Use logging or message tracing on the Iggy consumer to capture inbound message headers.
• Search for headers named CamelHttpUri or other Camel* headers in the captured messages.
• If using command-line tools, commands like 'grep' or 'jq' can be used to filter logs or message dumps for these headers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading Apache Camel to version 4.21.0 or 4.18.3, where the vulnerability is fixed by adding a dedicated IggyHeaderFilterStrategy that filters out Camel control headers on inbound messages.

If upgrading immediately is not possible, you should:

• Strip Camel control headers (Camel* and camel*) from inbound messages before they reach any downstream HTTP producer, for example by using removeHeaders('Camel*') and removeHeaders('camel*') at the start of the route.
• Restrict who can publish to the consumed Iggy stream or topic to trusted actors only.
• Avoid bridging an untrusted consumer directly into an HTTP producer whose target URI can be influenced by message headers.

Useful 0 Not Useful 0