Apache Camel Solr Component Vulnerability: Critical SSRF Risk
- Severity
- HIGH
- Affected component
- apache-camel-solr (maven)
- Patched version
- 4.21.0
An early warning has been issued for a critical vulnerability in the Apache Camel Solr component. Users of affected versions are advised to take immediate action to mitigate potential server-side request forgery attacks.
What happened
An early warning has been issued regarding a high-severity vulnerability in the Apache Camel Solr component. The issue, tracked as GHSA-4H4F-V54Q-7PQ8, involves improper neutralization of special elements in output used by a downstream component. This allows for server-side request forgery (SSRF) attacks. The vulnerability is reportedly due to the SolrParam. and SolrField. Exchange header prefixes using non-Camel-prefixed names, which bypass the HTTP header filter. This enables an HTTP client to inject Solr query parameters and document fields, potentially leading to SSRF attacks.
The affected versions are those before 4.14.8, 4.18.3, and 4.21.0. It is under investigation whether this vulnerability has been exploited in the wild. Users are advised to consult the primary sources for the most current information and to assess their exposure based on the version of the Apache Camel Solr component they are using.
What to do about it
- Upgrade to version 4.21.0 or to 4.14.8/4.18.3 for LTS releases to mitigate the vulnerability.
- Use CamelSolrParam./CamelSolrField. instead of SolrParam./SolrField. in routes to enhance security.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps that may be recommended.
How 0Day would have caught this
apache-camel-solr is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of the Apache Camel Solr component before 4.14.8, 4.18.3, or 4.21.0.
What should I do right now?
Immediately upgrade to version 4.21.0 or to 4.14.8/4.18.3 for LTS releases. Additionally, use CamelSolrParam./CamelSolrField. instead of SolrParam./SolrField. in your routes.
Has this been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time. However, it is under investigation.