CVE-2014-0002: High severity Apache Camel vulnerability
It was found that the Apache Camel XSLT component would resolve entities in XML messages when transforming them using an xslt: route. A remote attacker able to submit messages to an xslt: Camel route could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.
Other sources
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.camel:camel-coreto a version that resolves this vulnerability.Fixed in 2.12.3 - Upgrade
Upgrade
maven/org.apache.camel:camel-coreto a version that resolves this vulnerability.Fixed in 2.11.4 - Upgrade
Upgrade
Apache Camel XSLT componentto a version that resolves this vulnerability.Fixed in 2.11.4 - Upgrade
Upgrade
Apache Camel XSLT componentto a version that resolves this vulnerability.Fixed in 2.12.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0002?
CVE-2014-0002 is classified as a critical vulnerability because it allows remote attackers to read arbitrary files on the server.
How do I fix CVE-2014-0002?
To address CVE-2014-0002, upgrade the Apache Camel software to version 2.11.4 or 2.12.3 or later.
Which versions of Apache Camel are affected by CVE-2014-0002?
CVE-2014-0002 affects Apache Camel versions up to and including 2.11.3 and versions 1.0.0 through 2.11.3.
What types of attacks can exploit CVE-2014-0002?
CVE-2014-0002 can be exploited by an attacker who can submit XML messages to an xslt: route, leading to potential file disclosure.
Are there any mitigations for CVE-2014-0002?
There are no specific mitigations; the best practice is to apply the fix by upgrading to the recommended versions.