[prev in list] [next in list] [prev in thread] [next in thread]
List: full-disclosure
Subject: [Full-disclosure] CVE-2013-4330: Apache Camel critical disclosure vulnerability
From: Christian_Müller <christian.mueller () gmail ! com>
Date: 2013-09-30 10:24:47
Message-ID: CALvzYd98geyR+tHXcofLpcztpipRB+tk-iGvezAqAfeBXj3+Rg () mail ! gmail ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2013-4330: Apache Camel critical disclosure vulnerability
Severity: Critical
Vendor: The Apache Software Foundation
Versions Affected: Camel 2.9.0 to 2.9.7, Camel 2.10.0 to 2.10.6, Camel
2.11.0 to 2.11.1, Camel 2.12.0
The unsupported Camel 2.3.x, 2.4.x, 2.5.x, 2.6.x, 2.7.x and 2.8.x versions
may be also affected.
Description: When sending an Exchange with the in Message Header
'CamelFileName' with a value of '$simple{...}' to a FILE or FTP producer,
it will interpret the value as simple language expression which can be
exploited by a malicious user.
Mitigation: 2.9.x users should upgrade to 2.9.8, 2.10.x users should
upgrade to 2.10.7, 2.11.x users should upgrade to 2.11.2 and 2.12.0 users
should upgrade to 2.12.1. This patch will be included from Camel 2.13.0:
https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=27a9752a565fbef436bac4fcf22d339e3295b2a0
Example: Create a simple route which moves files from one directory to
another, e.g.:
from("file:c:/tmp/in")
.to("file:/c:/tmp/out");
If you are using Windows, create an file with the name
"$simple{camelContext.getClassResolver.resolveClass('java.lang.Runtime').getDeclaredMethods()[5].invoke(null,null).exec('calc.exe')}"
(without the quotes)
and drop it into the "c:/tmp/in" directory. The file consumer will read and
process this file. It will also set the Exchange in Message Header
'CamelFileName' with the value
"$simple{camelContext.getClassResolver.resolveClass('java.lang.Runtime').getDeclaredMethods()[5].invoke(null,null).exec('calc.exe')}".
In the next step, the file producer will interpreted the value of this
header as simple language expression and in this case, the Windows
calculator application will be started.
Credit: This issue was discovered by Grégory Draperi.
References: http://camel.apache.org/security-advisories.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJSSUxLAAoJEImh9lEqI5wsxY8P/2NUDc0uEbqMKCu+gp9n0yDz
+0JQebcQiIo/tuwmI6/HhQiF9asy3RZTQ4VCc6KelxWW7lB4Gmi9tq71bSfcf+uu
3o3ewNNbh+/vDcDKowOQnZlsD+9xW4fD/VOJt2obCapbLvS1tbLxY4lLly/fCETt
DJPExaAhicJQSX0X+jNAAJus5B0JUnAy2QMBj2ZDBPieH82RqtqQ44JtZsd/lyjH
d+PRhI44CLramTBX2HQYQtl/RR/sbzGosvbtQV91JL0j26dDMYDeLtVo+GWpjtw6
QuKrHvinBF6KKGd2aHEHYPP7yi2nQxlFlvPpEkf/YROKMR+JzyerZmsn5ziylrA7
NYlDsQ1LRRJOMiHC9aEOk5Y1++QoQ65EWJfRc2QB320tmGlCGUtXCM/nydyj7rDX
UOnnN9K5BMyPdk9qfgMWrUXVZyG8KKOwIDA9fMc4y/3wybllzBOsxidkDx8WbZsk
MWmoqtp7EJBIUAm4EmLV1LOD2tBBmXlA0GsdirgXgeoSYb/3lI6HRdMIS0HU3Uu8
jG7huiMrUTOkZz7Cs5Pome9ZFWkmfCrTSrOI6zTvcEleuimb2SK2FrHtymQi4dFh
DY7s63z52Ic1i7yJKLP5geVDQAaZesftwCFQtVJXF0+0uwuXUvOsCScaxNdVJM/Z
seH3FliiPjZJoEHV0fP7
=CQKT
-----END PGP SIGNATURE-----
On behalf of the Camel PMC,
Christian Müller
V.P. Apache Camel: https://www.apache.org/foundation/
[Attachment #5 (text/html)]
<div dir="ltr">-----BEGIN PGP SIGNED MESSAGE-----<br>Hash: SHA1<br><br>CVE-2013-4330: Apache \
Camel critical disclosure vulnerability<br><br>Severity: Critical<br><br>Vendor: The Apache \
Software Foundation<br><br>Versions Affected: Camel 2.9.0 to 2.9.7, Camel 2.10.0 to 2.10.6, \
Camel 2.11.0 to 2.11.1, Camel 2.12.0<br> The unsupported Camel 2.3.x, 2.4.x, 2.5.x, 2.6.x, \
2.7.x and 2.8.x versions may be also affected.<br><br>Description: When sending an Exchange \
with the in Message Header 'CamelFileName' with a value of '$simple{...}' to a \
FILE or FTP producer, it will interpret the value as simple language expression which can be \
exploited by a malicious user.<br> <br>Mitigation: 2.9.x users should upgrade to 2.9.8, 2.10.x \
users should upgrade to 2.10.7, 2.11.x users should upgrade to 2.11.2 and 2.12.0 users should \
upgrade to 2.12.1. This patch will be included from Camel 2.13.0: <a \
href="https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=27a9752a565fbef436bac4f \
cf22d339e3295b2a0">https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=27a9752a565fbef436bac4fcf22d339e3295b2a0</a><br>
<br>Example: Create a simple route which moves files from one directory to another, \
e.g.:<br>from("file:c:/tmp/in")<br> .to("file:/c:/tmp/out");<br><br>If you \
are using Windows, create an file with the name<br> \
"$simple{camelContext.getClassResolver.resolveClass('java.lang.Runtime').getDeclaredMethods()[5].invoke(null,null).exec('calc.exe')}" \
(without the quotes)<br>and drop it into the "c:/tmp/in" directory. The file consumer \
will read and process this file. It will also set the Exchange in Message Header \
'CamelFileName' with the value \
"$simple{camelContext.getClassResolver.resolveClass('java.lang.Runtime').getDeclaredMethods()[5].invoke(null,null).exec('calc.exe')}". \
In the next step, the file producer will interpreted the value of this header as simple \
language expression and in this case, the Windows calculator application will be started.<br> \
<br>Credit: This issue was discovered by Grégory Draperi.<br><br>References: <a \
href="http://camel.apache.org/security-advisories.html">http://camel.apache.org/security-advisories.html</a><br><br>-----BEGIN \
PGP SIGNATURE-----<br>
Version: GnuPG/MacGPG2 v2.0.18 (Darwin)<br>Comment: GPGTools - <a \
href="http://gpgtools.org">http://gpgtools.org</a><br><br>iQIcBAEBAgAGBQJSSUxLAAoJEImh9lEqI5wsxY \
8P/2NUDc0uEbqMKCu+gp9n0yDz<br>+0JQebcQiIo/tuwmI6/HhQiF9asy3RZTQ4VCc6KelxWW7lB4Gmi9tq71bSfcf+uu<br>
3o3ewNNbh+/vDcDKowOQnZlsD+9xW4fD/VOJt2obCapbLvS1tbLxY4lLly/fCETt<br>DJPExaAhicJQSX0X+jNAAJus5B0 \
JUnAy2QMBj2ZDBPieH82RqtqQ44JtZsd/lyjH<br>d+PRhI44CLramTBX2HQYQtl/RR/sbzGosvbtQV91JL0j26dDMYDeLtV \
o+GWpjtw6<br>QuKrHvinBF6KKGd2aHEHYPP7yi2nQxlFlvPpEkf/YROKMR+JzyerZmsn5ziylrA7<br> \
NYlDsQ1LRRJOMiHC9aEOk5Y1++QoQ65EWJfRc2QB320tmGlCGUtXCM/nydyj7rDX<br>UOnnN9K5BMyPdk9qfgMWrUXVZyG8 \
KKOwIDA9fMc4y/3wybllzBOsxidkDx8WbZsk<br>MWmoqtp7EJBIUAm4EmLV1LOD2tBBmXlA0GsdirgXgeoSYb/3lI6HRdMIS0HU3Uu8<br>jG7huiMrUTOkZz7Cs5Pome9ZFWkmfCrTSrOI6zTvcEleuimb2SK2FrHtymQi4dFh<br>
DY7s63z52Ic1i7yJKLP5geVDQAaZesftwCFQtVJXF0+0uwuXUvOsCScaxNdVJM/Z<br>seH3FliiPjZJoEHV0fP7<br>=CQKT<br>-----END \
PGP SIGNATURE-----<br><br><br>On behalf of the Camel PMC,<br clear="all"><div><div \
dir="ltr"><span style="font-family:arial,helvetica,sans-serif">Christian Müller<br> \
</span><br><span style="font-family:arial,helvetica,sans-serif">V.P. Apache Camel: <a \
href="https://www.apache.org/foundation/" \
target="_blank">https://www.apache.org/foundation/</a></span></div></div> </div>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic