Harry SintonenReminder to anyone using #ApacheCamel SCP/SFTP connections: Apache Camel does not perform host identity validation unless you explicitly configure "StrictHostKeyChecking" as "yes". The default value for "StrictHostKeyChecking" is "no". If you do not explicitly configure this option as "yes", the connections are susceptible to meddler in the middle attacks.
What is the impact of such insecure configuration?
If you are using SSH password authentication, the attacker in a privileged network position can perform full MiTM, grab the username and password, and thus gain authenticated access to the target server.
If you use a key-based authentication, the attacker cannot perform full MitM. However, they can still present a fake server and, in case of upload, steal the uploaded files. In case of download, the malicious server can present fake or malicious files for download.
So, any configuration that could get intercepted MUST always specify the host identity and use "StrictHostKeyChecking" "yes". Even configurations in secured networks should use "yes" for additional security.
Unfortunately, the Apache Camel documentation isn't clear on this topic, and the OpenSSH's similar option and its default value working in a different manner can easily lead to confusion and insecure configurations.
secbro42
InfoQ
OffSequence
LinuxTeck
Zineb Bendhiba
Otavio R. Piske