Apache Camel Quarkus
Monthly
Improper restriction of XML external entity resolution in the XSLT support extension of Apache Camel Quarkus (camel-quarkus-support-xalan) allows an attacker who supplies the XML document being transformed to read local files and to issue requests to internal network locations, because the bundled Xalan-J 2.7.x TransformerFactory predates JAXP 1.5 and cannot honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) rates this as network-reachable and unauthenticated with scope change and high confidentiality impact, though exploitation is conditional: the application must pull camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity onto the classpath, and on the xslt component path the attacker-controlled body must reach the transformer already as a javax.xml.transform.Source rather than a String, byte[], InputStream, DOMSource or StAXSource. Affected releases are 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0; patches exist in 3.33.3 and 3.40.0, and no public exploit has been identified at time of analysis.
Improper restriction of XML external entity resolution in the XSLT support extension of Apache Camel Quarkus (camel-quarkus-support-xalan) allows an attacker who supplies the XML document being transformed to read local files and to issue requests to internal network locations, because the bundled Xalan-J 2.7.x TransformerFactory predates JAXP 1.5 and cannot honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) rates this as network-reachable and unauthenticated with scope change and high confidentiality impact, though exploitation is conditional: the application must pull camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity onto the classpath, and on the xslt component path the attacker-controlled body must reach the transformer already as a javax.xml.transform.Source rather than a String, byte[], InputStream, DOMSource or StAXSource. Affected releases are 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0; patches exist in 3.33.3 and 3.40.0, and no public exploit has been identified at time of analysis.