Executive brief
Apache Camel's Salesforce connector allows integration routes to bridge HTTP requests into Salesforce operations. A flaw in the header filtering logic permits an unauthenticated HTTP client to inject Salesforce control headers (such as target SObject name, SOQL queries, or Apex REST endpoints) that are not properly blocked by the framework's security filter. An attacker can exploit this to read arbitrary data from Salesforce using the integration account's permissions, modify CRUD operations, or redirect API calls to unintended endpoints with injected parameters—all without requiring authentication.
Technical details
The camel-salesforce producer component reads operation parameters (SOQL queries, SOSL searches, target SObject names/IDs, Apex REST URLs, HTTP methods, and query parameters) from Exchange message headers with preference over endpoint configuration. The control-header constants in SalesforceEndpointConfig (e.g., sObjectQuery, sObjectSearch, sObjectName, sObjectId, apexUrl, apexMethod, apexQueryParam.*) use plain, non-Camel-prefixed names. Because HttpHeaderFilterStrategy only blocks headers in the Camel/camel namespace, these unfiltered control headers pass through HTTP boundaries unchecked. In routes that bridge HTTP consumers (such as platform-http) to salesforce: producers, an unauthenticated attacker can set these headers in HTTP requests to override intended parameters, supply arbitrary SOQL/SOSL queries to access any SObject, redirect CRUD operations to different targets, or steer Apex calls to different endpoints with injected parameters. All operations execute with the permissions of the connected Salesforce integration user, typically broad. Patches are available in versions 4.14.8, 4.18.3, and 4.21.0; workarounds include stripping untrusted control headers (sObject*, apex*) at route entry or parameterizing from trusted sources.
Affected products
- Apache Camel 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, 4.19.0 before 4.21.0
Timeline
- 2026-07-06: disclosed: Vulnerability published by GitHub Advisory Database and National Vulnerability Database
- 2026: patched: Patches released in Apache Camel 4.14.8, 4.18.3, and 4.21.0