Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 Message Header Injection (CVE-2025-27636)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(232840);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/03/18");

  script_cve_id("CVE-2025-27636");

  script_name(english:"Apache Camel 3.10.0 < 3.22.4 / 4.8.x < 4.8.5 / 4.10.x < 4.10.2 Message Header Injection (CVE-2025-27636)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains an integration framework that is affected by a message header injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Camel on the remote host is 3.10.0 prior to 3.22.4, 4.8.x prior to 4.8.5, or 4.10.x prior to
4.10.2. It is, therefore, affected by a message header injection vulnerability:

  - Bypass/Injection vulnerability in Apache Camel components under particular conditions. This issue affects Apache
    Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3. Users are
    recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This
    vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel
    specific headers that for some Camel components can alter the behaviours such as the camel-bean component, to call
    another method on the bean, than was coded in the application. (CVE-2025-27636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# https://lists.apache.org/thread/l3zcg3vts88bmc7w8172wkgw610y693z
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5d554999");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Camel version 3.22.4, 4.8.5, or 4.10.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-27636");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/03/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/03/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/03/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:camel");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_camel_jar_detect.nbin");

  exit(0);
}

include('vcf.inc');

var app_info =  vcf::get_app_info(app:'Apache Camel');

var constraints = [
  { 'min_version':'3.10.0', 'fixed_version':'3.22.4'},
  { 'min_version':'4.8.0',  'fixed_version':'4.8.5'},
  { 'min_version':'4.10.0', 'fixed_version':'4.10.2'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);