Severity:
CVSS 3.1: 8.2 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-as2) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-as2) 4.19.0 before 4.22.1
- Apache Camel (org.apache.camel:camel-as2) 4.18.5 unaffected
- Apache Camel (org.apache.camel:camel-as2) 4.22.1 unaffected
- Apache Camel (org.apache.camel:camel-as2) 4.23.0 unaffected
Description:
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before
4.22.1.
In the AS2 protocol the sender of a message may request that the Message
Disposition Notification be returned asynchronously to an address the sender
supplies. camel-as2 took that address from the inbound message and used it as
the destination for the outgoing receipt without constraining it to anything
the deployment had configured. A remote partner therefore chose the host the
Camel instance would connect to when delivering the MDN. That gives server-side
request forgery from the position of the AS2 receiver, including reaching hosts
that are only routable from inside the deployment's network, and where the
outbound connection carries credentials configured for MDN delivery those
credentials are presented to the attacker-chosen destination.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The asynchronous MDN destination is now
constrained rather than taken verbatim from the inbound message. For
deployments that cannot upgrade immediately, restrict outbound connectivity
from the AS2 receiver to the partner endpoints it legitimately delivers
receipts to, and do not attach credentials to MDN delivery that are valid for
any host other than those partners.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. The asynchronous MDN destination is now
constrained rather than taken verbatim from the inbound message.
Work Arounds:
For deployments that cannot upgrade immediately, restrict outbound connectivity
from the AS2 receiver to the partner endpoints it legitimately delivers
receipts to, and do not attach credentials to MDN delivery that are valid for
any host other than those partners.
Credit:
Claude Security (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-80344.html
https://issues.apache.org/jira/browse/CAMEL-24417
https://github.com/apache/camel/pull/25637
https://github.com/apache/camel/pull/25763
https://github.com/apache/camel/pull/25764
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-80344
