[jira] [Resolved] (CAMEL-24417) camel-as2 - asynchronous MDN delivery address is used without scheme validation and always over a plain socket

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24417?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino resolved CAMEL-24417.
--------------------------------------
    Resolution: Fixed

> camel-as2 - asynchronous MDN delivery address is used without scheme validation and always over a plain socket
> --------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24417
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24417
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-as2
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> When a received AS2 message carries a Receipt-Delivery-Option header, ResponseMDN (lines 202-207) stores its value as AS2AsynchronousMDNManager.RECIPIENT_ADDRESS, and AS2ServerConnection (lines 516-525) hands it to a new AS2AsynchronousMDNManager built with the connection's userName/password/accessToken.
> AS2AsynchronousMDNManager.send() then does:
>     URI uri = URI.create(recipientDeliveryAddress);
>     ... connFactory.createConnection(new Socket(uri.getHost(), uri.getPort()))
>     AS2HeaderUtils.addAuthorizationHeader(request, userName, password, accessToken);
> Three problems:
> 1. The URI scheme is never checked, and the connection is a plain java.net.Socket - an https delivery address is still contacted in clear text.
> 2. There is no allow-list tying the delivery address to the configured partner.
> 3. AS2HeaderUtils.addAuthorizationHeader() attaches the configured Basic or Bearer credential unconditionally, whatever host was selected.
> Proposal: validate the scheme, honour https by using the endpoint's SSLContextParameters, restrict delivery addresses to an operator-configured allow-list (empty = refuse asynchronous delivery to anything but the configured partner URL), and only attach credentials when the resolved host matches the configured partner. Also handle uri.getPort() == -1 rather than passing it to the Socket constructor.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)