Apache Camel Case-Variant Header Filter Bypass

This two-file repository contains a standalone Python 3 exploit and usage documentation for Apache Camel CVE-2025-27636. CVE-2025-27636.py uses requests to issue HTTP GET requests to a user-selected target's /command-center path. It places the executable and arguments in the CAmelExecCommandExecutable and CAmelExecCommandArgs headers, respectively, thereby attempting to reach Camel Exec command execution. The CLI offers one-shot command execution (-c), a repeated interactive command mode (-i), and reverse-shell mode (-r) using BusyBox netcat with a configurable callback host and port (default 4444). The README provides successful root-context examples, file-read examples, manual curl equivalents, and includes an example SSH private-key disclosure. It is functional exploit code rather than a scanner or detection-only script; no recognized exploit framework is used.

This repository is a functional Java/Spring Boot proof-of-concept reproducer for CVE-2026-40453 in Apache Camel. It is not just documentation: it contains a runnable vulnerable route, a bundled attacker client, Docker packaging, and clear exploit paths. The exploit demonstrates that Camel non-HTTP header filter strategies can be bypassed with case-variant Camel* header names because filtering is case-sensitive while the Camel Exchange header map is case-insensitive. Repository structure: Application.java is the Spring Boot entry point. CoapExecRoute.java defines the vulnerable Camel route from coap://0.0.0.0:5683/run to exec:echo?args=hello, making camel-exec the RCE sink. ExploitController.java exposes HTTP helper endpoints under /exploit that send CoAP requests to the local route: /normal sends no injected headers, /canonical sends CamelExecCommandExecutable and CamelExecCommandArgs as a control case, and /attack sends the bypass payload using CAmelExecCommandExecutable and CAmelExecCommandArgs. application.properties sets server.port=8080. Dockerfile and docker-compose.yml package and expose the app. Main exploit capability: remote command execution through header injection. The attack works by supplying CoAP URI query parameters that become Camel headers. Canonical CamelExecCommand* headers are filtered, but case-variant forms such as CAmelExecCommandExecutable bypass the vulnerable CoAPHeaderFilterStrategy and are later resolved by camel-exec under the canonical header names. In this PoC, the payload changes the executed command to /usr/bin/touch /tmp/pwned, proving code execution inside the container. The repository also demonstrates the negative case where /tmp/pwned-canonical should not be created. Operationally, this is an exploit reproducer rather than a generalized weaponized tool. It requires a vulnerable Camel deployment pattern: an untrusted producer (here camel-coap) feeding a header-sensitive downstream component (here camel-exec). The code is concise, self-contained, and purpose-built to validate the vulnerability and show exploitability.

This repository is a practical exploitation lab for CVE-2025-27636, a critical RCE vulnerability in Apache Camel's 'camel-exec' component. The vulnerability arises from case-sensitive filtering of internal headers, allowing attackers to bypass protections by altering header casing (e.g., 'cAmeLexecCommandExecutable'). The lab provides a Java application ('PinewoodAutoShopCamel.java') that sets up several HTTP endpoints using Apache Camel and Jetty, exposing routes such as '/tasks', '/systeminfo', and '/network'. These endpoints invoke OS commands via the 'exec:' component. The exploit is demonstrated by sending HTTP requests with specially-cased headers, resulting in arbitrary command execution on the server. The repository includes build files (pom.xml), configuration (application.properties), and a web UI (index.html). The exploit is a proof-of-concept and is intended for educational purposes only.

This repository provides a proof-of-concept (PoC) for exploiting two vulnerabilities (CVE-2025-27636 and CVE-2025-29891) in Apache Camel. The main exploit is a Java application (src/main/java/com/example/camel/VulnerableCamel.java) that sets up an HTTP endpoint at /vulnerable using the Camel Jetty and Exec components. By default, the endpoint executes the 'whoami' command, but due to improper filtering of HTTP headers and query parameters, an attacker can override the command by sending a specially cased 'CAmelExecCommandExecutable' header or query parameter, leading to arbitrary command execution (RCE). The repository also includes detection scripts (detection/CamelScanner.ps1 for PowerShell and detection/CamelScanner.sh for Bash) that scan file systems for vulnerable versions of the Apache Camel library by inspecting JAR files and their MANIFEST.MF files. These scripts are for detection only and do not perform exploitation. The repository structure is as follows: - README.MD: Detailed explanation of the vulnerabilities, exploitation steps, and affected versions. - src/main/java/com/example/camel/VulnerableCamel.java: The vulnerable Java application demonstrating the exploit. - detection/: Contains PowerShell and Bash scripts for detecting vulnerable Camel libraries, along with a README. - pom.xml: Maven configuration specifying dependencies on vulnerable Camel components. The main exploit capability is remote command execution via HTTP requests to the /vulnerable endpoint, targeting specific vulnerable versions of Apache Camel.