Deserialization of Untrusted Data in Apache Camel LevelDB

This repository is a small Spring Boot/Java proof-of-concept reproducer for CVE-2026-27172, a Java deserialization vulnerability in Apache Camel's camel-consul ConsulRegistry. The project is not a scanner or detection script; it actively demonstrates exploitation by exposing REST endpoints that initialize a Consul-backed registry entry, overwrite that entry with attacker-supplied Base64 serialized data, and then trigger Camel's vulnerable lookup path. Repository structure: pom.xml defines a Maven Spring Boot application using Java 17, camel-consul-starter and camel-spring-boot-starter at Camel 4.18.0 (explicitly vulnerable per the README), plus commons-collections 3.2.1 to ensure a gadget chain is present. Application.java is the Spring Boot entry point. ExploitController.java is the main exploit logic and the effective entry point for the PoC. ConsulRegistryRoute.java is intentionally disabled and only documents how a real Camel route would invoke lookupByName() during bean resolution. application.properties sets the web server to port 8080. Main exploit capabilities: ExploitController exposes GET /exploit/init to create a legitimate serialized value in Consul under key myProcessor using ConsulRegistry.put(); POST /exploit/inject to overwrite that same Consul KV key with an attacker-provided Base64 payload; GET /exploit/trigger to call ConsulRegistry.lookupByName("myProcessor"), which causes Base64 decoding and unsafe ObjectInputStream.readObject() deserialization in affected Camel versions; and GET /exploit/cleanup to remove the key. The exploit therefore demonstrates arbitrary code execution through attacker-controlled data in the Consul KV store when the application performs a registry lookup. Attack path: the attacker needs the ability to write to the Consul KV store used by the Camel application. Once a malicious serialized object is stored under a key that Camel resolves, any subsequent lookupByName()/lookupByNameAndType()/findByType* path can deserialize the payload. The README shows a ysoserial-generated CommonsCollections7 payload executing a benign command (touch /tmp/pwned), but the mechanism is generic arbitrary command execution via Java gadget chains. Notable endpoints and targets: the PoC app listens on localhost:8080 and uses a local Consul agent at http://localhost:8500. The specific Consul KV key targeted is myProcessor. The exploit is both web-exposed (through the PoC controller) and network-oriented (through interaction with the Consul service).

Repository purpose: a Spring Boot + Apache Camel proof-of-concept reproducer for an unsafe Java deserialization condition in Camel's LevelDB Aggregation Repository serializer (DefaultLevelDBSerializer uses raw ObjectInputStream without an ObjectInputFilter). The PoC demonstrates how a malicious serialized object placed into the LevelDB backing store can be deserialized during repository reads/recovery, leading to code execution if a gadget chain is available. Structure and key files: - pom.xml: Maven build; uses Spring Boot 3.2.0, Apache Camel 4.18.0-SNAPSHOT, and explicitly includes commons-collections:3.2.1 to ensure a known ysoserial gadget chain is on the classpath. - src/main/java/com/example/Application.java: Spring Boot entry point. - src/main/java/com/example/ExploitController.java: Main PoC logic exposing REST endpoints: - GET /exploit/init: creates /tmp/leveldb-exploit/aggregation.db, starts a LevelDBAggregationRepository named "myrepo", and writes a legitimate exchange under key "test-key". - POST /exploit/inject: accepts a hex string, converts to bytes, opens LevelDB directly (org.iq80.leveldb), and writes the bytes as the value for key "myrepo\0malicious-key" (repositoryName + NUL + correlationKey). This simulates an attacker gaining write access to the LevelDB store. - GET /exploit/trigger: starts the repository, enumerates keys, and calls repo.get(camelContext, key) for each key. This forces unmarshalling/deserialization of the stored bytes; a malicious entry triggers gadget execution. - GET /exploit/cleanup: deletes the LevelDB directory/files. - src/main/java/com/example/LevelDBRoute.java and StringAggregationStrategy.java: illustrative Camel aggregation route/strategy; route is intentionally disabled to avoid LevelDB file locking and keep the PoC manual. - src/main/resources/application.properties: sets server.port=8080. Exploit capabilities: - Writes attacker-controlled serialized bytes into the LevelDB store (via provided HTTP endpoint in this PoC). - Triggers deserialization by invoking LevelDBAggregationRepository.get() over stored keys. - Achieves RCE when a gadget chain is present (the project includes commons-collections 3.2.1; README suggests generating payloads with ysoserial CommonsCollections7). Notes on realism/conditions: - In real deployments, the primary prerequisite is an attacker-controlled write into the LevelDB persistence (filesystem access or another vulnerability). This PoC adds a network-accessible injection endpoint to make the condition easy to reproduce.