CVE-2017-5643: SSRF
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Other sources
Description: The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources.
Mitigation: 2.17.x users should upgrade to 2.17.6, 2.18.x users should upgrade to 2.18.3.
The JIRA tickets https://issues.apache.org/jira/browse/CAMEL-10894 refers to the various commits that resolved the issue, and have more details.
The Validation Component of Apache Camel evaluates DTD headers of XML stream sources, although a validation against XML schemas (XSD) is executed. Remote attackers can use this feature to make Server-Side Request Forgery (SSRF) attacks by sending XML documents with remote DTDs URLs or XML External Entities (XXE). The vulnerability is not given for SAX or StAX sources.
Versions Affected: Camel 2.17.0 to 2.17.5, Camel 2.18.0 to 2.18.2 The unsupported Camel 2.x (2.16 and earlier) versions may be also affected.
External Reference:
https://camel.apache.org/security-advisories.data/CVE-2017-5643.txt
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.camel:camel-coreto a version that resolves this vulnerability.Fixed in 2.18.2 - Upgrade
Upgrade
maven/org.apache.camel:camel-coreto a version that resolves this vulnerability.Fixed in 2.17.6 - Upgrade
Upgrade
redhat/camel-coreto a version that resolves this vulnerability.Fixed in 2.17.6 - Upgrade
Upgrade
redhat/camel-coreto a version that resolves this vulnerability.Fixed in 2.18.3 - Upgrade
Upgrade
apache/camelto a version that resolves this vulnerability.Fixed in 2.17.6 - Upgrade
Upgrade
apache/camelto a version that resolves this vulnerability.Fixed in 2.18.3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5643?
CVE-2017-5643 has a moderate severity level due to its potential exploitation via Server-Side Request Forgery (SSRF) using remote DTDs and XML External Entity (XXE).
How do I fix CVE-2017-5643?
To fix CVE-2017-5643, upgrade Apache Camel to version 2.18.2 or 2.17.6 or later.
Which versions are affected by CVE-2017-5643?
CVE-2017-5643 affects various versions of Apache Camel, specifically versions prior to 2.17.6 and 2.18.2.
What kind of attacks can exploit CVE-2017-5643?
CVE-2017-5643 allows attackers to exploit SSRF vulnerabilities through remote DTDs and perform XXE attacks.
Is there a specific version of Apache Camel that is a safe upgrade for CVE-2017-5643?
Yes, upgrading to Apache Camel version 2.18.2 or 2.17.6 or their later versions mitigates the risk associated with CVE-2017-5643.