Apache Camel HTTP Components Client Certificate & Private Key Cleartext Leak

CAMEL-24462 Vulnerability Summary Vulnerability Overview When invoking HTTPS endpoints, the Camel component incorrectly transmits client certificates and private keys in plaintext to the Authority (authentication server) instead of sending them solely to the target endpoint. This results in the exposure of sensitive credentials during transmission, posing a severe security risk. This issue stems from incorrectly binding client certificates and private keys to the entire connection pool or authentication flow during SSL context configuration, rather than restricting their use to the final target host verification. --- Scope of Impact Affected Components: Camel HTTP client components (specifically implementations using ) Affected Versions: - Camel 3.x series (e.g., 3.18.0, 3.19.0, 3.20.0, etc.) - Camel 4.x series (e.g., 4.0.0, 4.1.0, 4.2.0, etc.) Trigger Conditions: - Accessing endpoints requiring mutual TLS (mTLS) via the HTTPS protocol - Client certificates and private keys are configured - is used as the underlying HTTP client --- Remediation The official team has fixed this issue in subsequent versions: Fixed Versions: - Camel 3.21.0+ - Camel 4.3.0+ Fix Details: - Modified the SSL context configuration logic in to ensure client certificates and private keys are used only for target endpoint verification and are not sent to the authentication server. - Implemented more secure default behaviors to prevent credential leakage. > ✅ Users are advised to upgrade to the aforementioned fixed versions or manually adjust SSL configurations to mitigate risks. --- POC / Exploitation Code (No direct exploit code available; reproduction configuration provided) The following is a typical configuration example that triggers this vulnerability (for testing or reproduction): > ⚠️ Note: In affected versions, the above configuration causes client certificates and private keys to be transmitted in plaintext to the authentication server. --- Additional Information CVE ID: Unassigned (as of the snapshot date) Reporter: @jstrachan Fix Commit: https://github.com/apache/camel/pull/... (Specific PR number requires repository lookup) Related Components: , , --- ✅ It is recommended that all users employing Camel for HTTPS mutual TLS authentication immediately check and upgrade their versions.

Goal Reached Thanks to every supporter — we hit 100%!

Apache Camel HTTP Components Client Certificate & Private Key Cleartext Leak

More from this source