Apache Camel 4.8.0 < 4.8.6 / 4.10.0 < 4.10.3 – Camel-Undertow Bypass/Injection Vulnerability (CVE-2025-30177)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265334);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/17");

  script_cve_id("CVE-2025-30177");

  script_name(english:"Apache Camel 4.8.0 < 4.8.6 / 4.10.0 < 4.10.3 – Camel-Undertow Bypass/Injection Vulnerability (CVE-2025-30177)");

  script_set_attribute(attribute:"synopsis", value:
"A Camel message header injection vulnerability exists in the Camel-Undertow component of Apache Camel.");
  script_set_attribute(attribute:"description", value:
"This issue affects Apache Camel: from 4.10.0 before 4.10.3, from 4.8.0 before 4.8.6. It is, therefore, affected by
 a message header injection vulnerability:

  - Bypass/Injection vulnerability in Apache Camel components under particular conditions. In particular the custom
    header filter strategy used by the component
    only filter the 'out' direction, while it doesn't filter the 'in' direction.Users are recommended to upgrade to
    ersion 4.10.3 for 4.10.x LTS and 4.8.6 for 4.8.x LTS. 
    This allows an attacker to include Camel specific headers that for some Camel components can alter the behaviour
    such as the camel-bean component, or the camel-exec component.
    
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");

  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/dj79zdgw01j337lr9gvyy4sv8xfyw8py");
  script_set_attribute(attribute:"solution", value:"Upgrade to Apache Camel version 4.8.6 or 4.10.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-30177");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:camel");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_camel_jar_detect.nbin");
  script_require_keys("installed_sw/Apache Camel");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache Camel', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version': '4.8.0',  'fixed_version': '4.8.6' },
        { 'min_version': '4.10.0', 'fixed_version': '4.10.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);