Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages

Primary CVSS: v3.1 8.8 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.007690000 probability, percentile 0.548730000 (date 2026-10-20)

Problem Types: CWE-94 | CWE-917 | CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection') | CWE-917 CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Discovery Credit

CNA: Leon Zlobecki (en)

CNA: Andrea Cosentino (en)

Solutions

CNA: Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. After upgrading, a control message that carries a predicate expression or an expression language is rejected unless the new allowPredicateFromMessage option is enabled on the dynamic-router-control endpoint; enable it only when every sender of control messages is trusted. A new allowPredicateFromMessage option on the dynamic-router-control endpoint, defaulting to false, now decides whether the subscription predicate and its expression language may be taken from a control message. When it is false, a subscribe or update request whose DynamicRouterControlMessage body or headers carry a predicate expression or an expression language is rejected with an IllegalArgumentException, and the predicate and expressionLanguage configured on the endpoint are used instead. The option is not mapped from any message header, and the toD optimisation keeps it on the endpoint URI, so only the route author can enable it. The header form of a control message now also falls back to the endpoint configuration for parameters the message does not carry, so a subscription can be declared entirely on a static endpoint URI. Subscriptions that reference a predicate bean from the registry, or that pass a Predicate instance in the message body, are unchanged. On 4.23.0 and 4.22.1 the option is additionally marked as an insecure:dev security option, so the security policy framework treats an endpoint that enables it as insecure, which fails by default when camel.main.profile is set to prod, and the dynamic-router endpoint gains an allowedSchemes option, unset by default, that restricts which endpoint schemes a subscription's destinationUri may use. The 4.18.5 release carries the allowPredicateFromMessage option only, because the security-option metadata and the recipient-list scheme allow-list that the other two releases build on are not present on that maintenance line.

Workarounds

CNA: For deployments that cannot upgrade immediately, do not forward messages from untrusted or shared transports to a dynamic-router-control endpoint. Where control messages must cross such a transport, authenticate the sender and make sure the predicate and expression language of each subscription are set by the route rather than taken from the incoming message, for example by removing the CamelDynamicRouterPredicate and CamelDynamicRouterExpressionLanguage headers and clearing the predicate and expressionLanguage fields of a DynamicRouterControlMessage before it reaches the endpoint. Removing optional expression languages from the classpath is not a sufficient workaround. As defence in depth, restrict who can send to the transports that feed the control endpoint, and on 4.23.0 and 4.22.1 set the allowedSchemes option of the dynamic-router endpoint to limit which endpoints a subscription's destinationUri may name.