Loading vulnerability…
Cross-host redirect credential disclosure in Apache Camel HTTP component
Apache Camel HTTP component exposes authentication credentials to unauthorized redirect destinations when followRedirects=true. Affected versions are 4.0.0 through versions before 4.18.5, and 4.19.0 through versions before 4.22.1. OAuth2ClientConfigurer registers a request interceptor using addRequestInterceptorFirst. Because protocol-level interceptors execute within ProtocolExec below RedirectExec, the interceptor runs again for each redirect hop and reattaches the OAuth2 bearer token even when the destination host changes. Separately, Basic and Digest credentials are registered with an AuthScope matching any host, making them available for authentication to redirect destinations. A malicious endpoint or an attacker able to influence its responses can redirect requests to an attacker-controlled host to capture credentials.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthorized redirect destination can obtain OAuth2 bearer tokens or configured Basic/Digest authentication credentials. Captured authentication material can potentially enable impersonation and unauthorized access to services, subject to the credentials' scope, privileges, validity, and authentication requirements.
If you can’t patch tonight, do this now.
Set followRedirects=false on HTTP endpoints carrying credentials. Handle redirects explicitly in the Camel route so that the route controls the destination rather than automatically accepting a destination selected by the remote server.
Patch, then assume compromise.
Upgrade to Apache Camel 4.23.0, 4.18.5 for the 4.18.x LTS stream, or 4.22.1 for the 4.22.x LTS stream. These fixes restrict credentials to the configured endpoint authority and prevent their reattachment when redirects cross to another host.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.