CVE-2026-71300

总结

Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atmosphere-websocket producer selects which connected WebSocket peers a message is delivered to through Exchange headers, and the string values of those headers sat outside the Camel namespace: websocket.connectionKey and websocket.connectionKey.list, along with websocket.sendToAll, websocket.eventType and websocket.errorType. WebsocketEndpoint extends ServletEndpoint and so inherits HttpHeaderFilterStrategy, which filters only the Camel and camel prefixes; the dotted names therefore fell outside the filtered namespace and were admitted in both directions by every HTTP-family consumer. In a route bridging an HTTP consumer into an atmosphere-websocket producer, an external sender could supply the list header and take over the producer's dispatch decision. WebsocketProducer.process tests the list header before the single-key header, so an injected value discarded the recipient the route had selected: a notification intended for one connected client could be suppressed, or delivered instead to a different client whose connection key the sender knows. The header need not be a query parameter and need not be supplied as a list literally - Camel's HTTP binding promotes a repeated header name, and a bracketed value, to a List when mapping onto the Exchange - so an ordinary inbound HTTP header is sufficient to reach the list-valued branch. This is distinct from CVE-2026-55993, which concerns the consumer-side query-parameter path in the same component. The behaviour dates back to the introduction of these constants, first released in 2.17.0, and was unchanged until this fix. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, strip the dispatch headers at the trust boundary before the producer, for example with removeHeaders(“websocket.*”) placed between the HTTP consumer and the atmosphere-websocket producer. Note that the fix renames the header string values into the Camel namespace, which is a breaking change for routes that set them by literal string: routes referencing the WebsocketConstants fields symbolically are unaffected, and the change is documented in the upgrade guides. As defence in depth, do not bridge an untrusted HTTP consumer directly into a WebSocket producer whose dispatch is header-driven without stripping the dispatch namespace first. Apache Camel Atmosphere Websocket 组件存在输入验证不当漏洞。该问题影响 Apache Camel：自 4.0.0 起至 4.14.9 之前、自 4.15.0 起至 4.18.4 之前、自 4.19.0 起至 4.22.0 之前。camel-atmosphere-websocket 生产者通过 Exchange 头选择消息要送达的已连接 WebSocket 对等端，而这些头的字符串值位于 Camel 命名空间之外：websocket.connectionKey 和 websocket.connectionKey.list，以及 websocket.sendToAll、websocket.eventType 和 websocket.errorType。WebsocketEndpoint 继承自 ServletEndpoint，因此继承了 HttpHeaderFilterStrategy，而后者仅过滤 Camel 和 camel 前缀；因此这些以点号分隔的名称落在被过滤的命名空间之外，并被所有 HTTP 类消费者在双向接受。在将 HTTP 消费者桥接到 atmosphere-websocket 生产者的路由中，外部发送者可以提供 list 头并接管生产者的分发决策。WebsocketProducer.process 在单个键头之前先测试 list 头，因此注入的值会丢弃路由原本选择的接收者：本应发送给某个已连接客户端的通知可能被抑制，或转而发送给发送者知道其连接密钥的另一个客户端。该头不必是查询参数，也不必以字面列表形式提供——Camel 的 HTTP 绑定在映射到 Exchange 时，会将重复的头名称和带括号的值提升为 List——因此一个普通的入站 HTTP 头就足以到达 list 值分支。这不同于 CVE-2026-55993，后者涉及同一组件中消费者侧的查询参数路径。该行为可追溯到这些常量引入之时，即首次发布于 2.17.0，直到此修复前一直未变。建议用户升级到修复该问题的 4.22.0 版本。如果用户使用 4.14.x LTS 发布流，建议升级到 4.14.9。如果用户使用 4.18.x 发布流，建议升级到 4.18.4。对于无法立即升级的部署，请在生产者之前的信任边界处剥离分发头，例如在 HTTP 消费者与 atmosphere-websocket 生产者之间放置 `removeHeaders(“websocket.*”)`。请注意，该修复将头的字符串值重命名到 Camel 命名空间内，这对于通过字面字符串设置这些值的路由来说是一项破坏性变更：以符号方式引用 `WebsocketConstants` 字段的路由不受影响，且此变更已在升级指南中说明。作为纵深防御，请勿在未先剥离分发命名空间的情况下，将不受信任的 HTTP 消费者直接桥接到分发由头驱动的 WebSocket 生产者。