CVE-2024-22371: Apache Camel Information Disclosure Bug

CVE-2024-22371 Overview

CVE-2024-22371 is a sensitive data exposure vulnerability in Apache Camel, the open-source integration framework. An attacker can craft a malicious EventFactory and supply a custom ExchangeCreatedEvent that exposes sensitive data carried inside Camel exchanges. The flaw is classified under [CWE-922: Insecure Storage of Sensitive Information] and is exploitable over the network without authentication or user interaction. Affected releases include Apache Camel 3.21.X through 3.21.3, 3.22.0, 4.0.X through 4.0.3, and 4.X through 4.3.0. The Apache Camel project has released fixed versions 3.21.4, 3.22.1, 4.0.4, and 4.4.0.

Critical Impact

Attackers can extract confidential information from Camel exchanges by injecting a malicious event factory, breaking the confidentiality of integration data in transit between components.

Affected Products

• Apache Camel 3.21.X through 3.21.3
• Apache Camel 3.22.0 and 4.0.X through 4.0.3
• Apache Camel 4.X through 4.3.0

Discovery Timeline

• 2024-02-26 - CVE-2024-22371 published to NVD
• 2025-04-25 - Last updated in NVD database

Technical Details for CVE-2024-22371

Vulnerability Analysis

Apache Camel uses an event notification system to publish lifecycle events such as ExchangeCreatedEvent whenever a new message exchange begins. The framework allows applications to register a custom EventFactory that produces these event objects. The vulnerability arises because the event subsystem does not adequately restrict what a custom EventFactory can expose when generating an ExchangeCreatedEvent. A hostile factory can attach or serialize sensitive payload data from the exchange into the event, which is then propagated to listeners, logs, or downstream consumers that were not intended to receive it. The result is unintended disclosure of message headers, body content, or routing properties that may include credentials, tokens, or business data.

Root Cause

The root cause is insecure handling of sensitive data inside the Camel event factory abstraction, mapped to [CWE-922]. Camel trusts the EventFactory implementation to safely construct events and does not enforce boundaries between sensitive exchange state and externally observable event data. When a malicious or compromised factory is loaded, that trust boundary collapses.

Attack Vector

Exploitation requires the attacker to influence the EventFactory used by the Camel context, typically by supplying a crafted implementation via classpath, configuration, or plugin mechanisms. Once registered, the factory emits ExchangeCreatedEvent instances that leak exchange contents to any code path observing Camel events. Because the attack runs through normal Camel event flow, the leakage is not visible as an obvious protocol-level compromise. Refer to the Apache Camel CVE-2024-22371 Advisory for vendor technical details.

Detection Methods for CVE-2024-22371

Indicators of Compromise

• Unexpected custom EventFactory or EventNotifier implementations registered in the Camel context at startup.
• Log entries or event streams containing exchange body or header values that should never leave the route.
• New JARs or classes in the application classpath implementing org.apache.camel.spi.EventFactory.

Detection Strategies

• Inventory Apache Camel versions across services and flag any instance in the 3.21.X–3.21.3, 3.22.0, 4.0.X–4.0.3, or 4.X–4.3.0 ranges.
• Audit Camel context configuration and Spring or Quarkus bean definitions for non-default EventFactory registrations.
• Inspect event listener output, log aggregators, and message brokers for exchange payload fields appearing in event metadata.

Monitoring Recommendations

• Forward Camel application logs and JMX events to a central data lake and alert on anomalous event payload sizes or sensitive field patterns.
• Monitor build pipelines and artifact repositories for the introduction of classes implementing Camel SPI interfaces.
• Track outbound traffic from integration hosts for unexpected destinations that may be receiving leaked event data.

How to Mitigate CVE-2024-22371

Immediate Actions Required

• Upgrade Apache Camel to 3.21.4, 3.22.1, 4.0.4, or 4.4.0 as appropriate for your branch.
• Review the Camel context for any custom EventFactory or EventNotifier and remove untrusted implementations.
• Rotate any credentials, API keys, or tokens that may have transited Camel exchanges on vulnerable versions.

Patch Information

The Apache Camel project resolved CVE-2024-22371 in versions 3.21.4, 3.22.1, 4.0.4, and 4.4.0. Patch details and upgrade instructions are available in the Apache Camel CVE-2024-22371 Advisory.

Workarounds

• Restrict the application classpath so that only vetted EventFactory implementations can be loaded by the Camel context.
• Disable event notification (camel.main.use-breadcrumb=false and remove custom notifiers) where event publishing is not required by the integration.
• Apply data masking on sensitive headers and body fields before exchanges are processed by routes that publish events.