Apache Camel incoming header filter bypass/injection

This repository is a practical exploitation lab for CVE-2025-27636, a critical RCE vulnerability in Apache Camel's 'camel-exec' component. The vulnerability arises from case-sensitive filtering of internal headers, allowing attackers to bypass protections by altering header casing (e.g., 'cAmeLexecCommandExecutable'). The lab provides a Java application ('PinewoodAutoShopCamel.java') that sets up several HTTP endpoints using Apache Camel and Jetty, exposing routes such as '/tasks', '/systeminfo', and '/network'. These endpoints invoke OS commands via the 'exec:' component. The exploit is demonstrated by sending HTTP requests with specially-cased headers, resulting in arbitrary command execution on the server. The repository includes build files (pom.xml), configuration (application.properties), and a web UI (index.html). The exploit is a proof-of-concept and is intended for educational purposes only.

This repository provides a proof-of-concept (PoC) for exploiting two vulnerabilities (CVE-2025-27636 and CVE-2025-29891) in Apache Camel. The main exploit is a Java application (src/main/java/com/example/camel/VulnerableCamel.java) that sets up an HTTP endpoint at /vulnerable using the Camel Jetty and Exec components. By default, the endpoint executes the 'whoami' command, but due to improper filtering of HTTP headers and query parameters, an attacker can override the command by sending a specially cased 'CAmelExecCommandExecutable' header or query parameter, leading to arbitrary command execution (RCE). The repository also includes detection scripts (detection/CamelScanner.ps1 for PowerShell and detection/CamelScanner.sh for Bash) that scan file systems for vulnerable versions of the Apache Camel library by inspecting JAR files and their MANIFEST.MF files. These scripts are for detection only and do not perform exploitation. The repository structure is as follows: - README.MD: Detailed explanation of the vulnerabilities, exploitation steps, and affected versions. - src/main/java/com/example/camel/VulnerableCamel.java: The vulnerable Java application demonstrating the exploit. - detection/: Contains PowerShell and Bash scripts for detecting vulnerable Camel libraries, along with a README. - pom.xml: Maven configuration specifying dependencies on vulnerable Camel components. The main exploit capability is remote command execution via HTTP requests to the /vulnerable endpoint, targeting specific vulnerable versions of Apache Camel.