Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation

The vulnerability lies within the camel-castor component, which handles data serialization and deserialization. An attacker can exploit this flaw by sending a specially crafted serialized object to a Camel route that utilizes the camel-castor component. Upon deserialization, this malicious object can trigger arbitrary code execution on the server hosting the Camel application. The potential impact is severe, including complete system compromise, data theft, and denial of service. This vulnerability shares similarities with other deserialization exploits, potentially allowing for remote command execution with the privileges of the Camel process. The blast radius extends to any system relying on vulnerable Camel deployments.

Organizations utilizing Apache Camel in their integration solutions are at risk, particularly those relying on older versions (≤2.9.8, 2.20.x before 2.20.1). Systems with exposed Camel endpoints are especially vulnerable. Applications that process untrusted data through Camel routes are also at heightened risk.

• java / server:

find / -name "camel-castor*.jar" -print

• java / server:

ps -ef | grep -i camel

• java / server: Examine Camel route configurations for usage of the camel-castor component and any deserialization operations. • java / server: Monitor Camel logs for deserialization errors or suspicious activity related to the camel-castor component.

1. 2017-11-15Discovery

   discovery

2. 2018-10-16Disclosure

   disclosure

3. 2018-10-16PoC

   poc

4. 2018-10-16Patch

   patch

1. Gepubliceerd2018-10-16
2. Gewijzigd2024-02-16
3. EPSS bijgewerkt2026-04-02

The primary mitigation is to upgrade Apache Camel to version 2.19.4 or later. If upgrading immediately is not feasible, consider implementing input validation to sanitize data before deserialization. This could involve whitelisting allowed classes or using a secure deserialization library. As a temporary workaround, restrict network access to Camel routes that utilize the camel-castor component. Monitor Camel logs for suspicious deserialization activity. Implement a Web Application Firewall (WAF) with rules to detect and block malicious serialized payloads. After upgrading, verify the fix by attempting to deserialize a known malicious payload and confirming that it is rejected.