Apache Camel camel-mongodb-gridfs Vulnerability: Early Warning
An early warning has been issued regarding a potential vulnerability in Apache Camel's camel-mongodb-gridfs component, which may allow for GridFS operation override and NoSQL operator injection. Users of affected versions are advised to upgrade.
What happened
An early warning has been issued for a potential vulnerability tracked as GHSA-F7G3-2CG6-F5HJ, reportedly affecting Apache Camel's camel-mongodb-gridfs component. The vulnerability appears to allow for improper input validation and improper access control, enabling GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers. This issue is under investigation, and it is recommended that users upgrade to Apache Camel version 4.21.0 or the respective latest version in the 4.14.x and 4.18.x LTS release streams to mitigate potential risks. Affected components include camel-mongodb-gridfs (maven) versions <4.14.8, <4.18.3, and <4.21.0. For more detailed information, primary sources should be consulted.
How 0Day mitigates this
camel-mongodb-gridfs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.