#VU105455 Improper Neutralization of HTTP Headers for Scripting Syntax in Apache Camel - CVE-2025-27636
Published: March 10, 2025 / Updated: April 11, 2025
Vulnerability identifier: #VU105455
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/U:Green
CVE-ID: CVE-2025-27636
CWE-ID: CWE-644
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Apache Camel
Apache Camel
Software vendor:
Apache Foundation
Apache Foundation
Description
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to improper input validation when processing HTTP requests, as filters are configured to only block headers starting with "Camel", "camel", or "org.apache.camel". A remote non-authenticated attacker can send a specially crafted HTTP request with altered casing of letters in headers that will be accepted by the application.
Successful exploitation of the vulnerability may allow an attacker to perform cross-site scripting, cache poisoning or session hijacking attacks.
Remediation
Install updates from vendor's website.