Andrea Cosentino created CAMEL-24417:
----------------------------------------
Summary: camel-as2 - asynchronous MDN delivery address is used
without scheme validation and always over a plain socket
Key: CAMEL-24417
URL: https://issues.apache.org/jira/browse/CAMEL-24417
Project: Camel
Issue Type: Bug
Components: camel-as2
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
When a received AS2 message carries a Receipt-Delivery-Option header,
ResponseMDN (lines 202-207) stores its value as
AS2AsynchronousMDNManager.RECIPIENT_ADDRESS, and AS2ServerConnection (lines
516-525) hands it to a new AS2AsynchronousMDNManager built with the
connection's userName/password/accessToken.
AS2AsynchronousMDNManager.send() then does:
URI uri = URI.create(recipientDeliveryAddress);
... connFactory.createConnection(new Socket(uri.getHost(), uri.getPort()))
AS2HeaderUtils.addAuthorizationHeader(request, userName, password,
accessToken);
Three problems:
1. The URI scheme is never checked, and the connection is a plain
java.net.Socket - an https delivery address is still contacted in clear text.
2. There is no allow-list tying the delivery address to the configured partner.
3. AS2HeaderUtils.addAuthorizationHeader() attaches the configured Basic or
Bearer credential unconditionally, whatever host was selected.
Proposal: validate the scheme, honour https by using the endpoint's
SSLContextParameters, restrict delivery addresses to an operator-configured
allow-list (empty = refuse asynchronous delivery to anything but the configured
partner URL), and only attach credentials when the resolved host matches the
configured partner. Also handle uri.getPort() == -1 rather than passing it to
the Socket constructor.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
