Apache Camel Azure Storage Blob: Path Traversal Vulnerability Alert
- Severity
- HIGH
- Affected component
- camel-azure-storage-blob (maven)
- Patched version
- Not yet available
An early warning has been issued for a critical path traversal vulnerability in the Apache Camel Azure Storage Blob component. This vulnerability affects specific versions of the component and could allow an attacker to overwrite files outside the intended directory.
What happened
An early warning has been issued for a critical path traversal vulnerability in the Apache Camel Azure Storage Blob component. This vulnerability, tracked as GHSA-2X37-89HJ-2J95, reportedly allows an attacker to overwrite files outside the intended directory. The vulnerability affects versions 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0 of the camel-azure-storage-blob (maven) component. The issue arises from the downloadBlobToFile operation, which builds the local download target from the remote blob name without constraining it to the configured fileDir.
This vulnerability is under investigation and has not yet been exploited in the wild. It is crucial for users of the affected versions to assess their exposure and take immediate action to mitigate potential risks.
What to do about it
- Identify if your system uses the camel-azure-storage-blob component in the affected version ranges.
- Upgrade to the latest version of the Apache Camel Azure Storage Blob component that is not affected by this vulnerability.
- Monitor the primary sources for updates on the vulnerability and any official fixes that may be released.
- Review your system's file directory configurations to ensure they are secure and not susceptible to path traversal attacks.
- Consider implementing additional security measures to protect against potential path traversal attacks.
How 0Day would have caught this
camel-azure-storage-blob is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using versions 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, or 4.19.0 before 4.22.0 of the camel-azure-storage-blob (maven) component.
What should I do right now?
Immediately identify if your system uses the affected versions of the camel-azure-storage-blob component and upgrade to the latest version that is not affected by this vulnerability.
Has an official fix been released?
No official fix has been published yet. Monitor the primary sources for updates on any official fixes that may be released.
What is the severity of this vulnerability?
The severity of this vulnerability is classified as HIGH.