Unsafe Deserialization in Apache Camel Camel-PQC FileBasedKeyLifecycleManager

This repository is a self-contained Java/Spring Boot proof-of-concept exploit for Apache Camel camel-pqc unsafe deserialization, CVE-2026-46590. It is not part of a common exploit framework. The repo contains a minimal web application that exposes a single GET endpoint, /exploit/attack, which demonstrates exploitation against FileBasedKeyLifecycleManager in vulnerable camel-pqc versions (camel.version pinned to 4.18.2 in pom.xml). Structure and purpose: Application.java is the Spring Boot entry point. ExploitController.java contains the main exploit flow: it creates a temporary key directory, writes an attacker-controlled legacy serialized key file named victim-key.key, instantiates FileBasedKeyLifecycleManager on that directory, and calls manager.getKey("victim-key"). Because the vulnerable manager migrates legacy .key files using raw ObjectInputStream.readObject() without an ObjectInputFilter, the malicious object is deserialized before the KeyPair cast fails. Gadget.java builds the CommonsCollections6 gadget chain using commons-collections 3.2.1 and reflection into java.util internals. application.properties configures the app to listen on port 8080. Dockerfile and docker-compose.yml provide a reproducible containerized environment. Main exploit capability: arbitrary command execution during deserialization, provided the attacker can write to the key backend used by FileBasedKeyLifecycleManager. The PoC uses a benign hardcoded payload, /usr/bin/touch /tmp/pwned, and then checks for the existence of /tmp/pwned as proof of execution. The exploit is operational rather than weaponized because the payload is hardcoded and the app is purpose-built for demonstration. Attack path: this is primarily a local/file-based exploit condition against the target application's key storage, wrapped in a web-triggerable demo interface. The attacker-controlled input is the planted legacy .key file; the victim action is a routine getKey() call. The exposed HTTP endpoint is only for triggering the demonstration in the PoC environment, not the underlying vulnerability itself. Notable targeting details: README states affected versions are 4.18.0 before 4.18.3 and 4.19.0 before 4.21.0. It also references related incomplete remediation history (CVE-2026-40048) and a sibling AWS Secrets Manager issue (CVE-2026-43867), but the implemented code specifically targets the file-based manager path.

This repository is a compact Spring Boot reproducer for CVE-2026-40048, a Java unsafe deserialization issue in Apache Camel's camel-pqc component, specifically FileBasedKeyLifecycleManager.getKey(). The project contains 8 files total, with the main logic in two Java source files: Application.java starts the web app, and ExploitController.java exposes HTTP endpoints that simulate attacker write access and then trigger the vulnerable deserialization path. The Maven build (pom.xml) intentionally pins camel-pqc to vulnerable version 4.18.1 and includes commons-collections 3.2.1 to ensure a usable gadget chain is present. The app listens on port 8080 and is packaged for Docker execution via Dockerfile and docker-compose.yml. Exploit flow: POST /exploit/inject accepts a Base64-encoded serialized payload, decodes it, and writes it to /tmp/pqc-keys/mykey.key. GET /exploit/trigger then creates a new FileBasedKeyLifecycleManager pointing at /tmp/pqc-keys and calls getKey("mykey"), causing ObjectInputStream.readObject() to deserialize the attacker-controlled file. The code explicitly notes that gadget execution occurs before the eventual KeyPair cast, so even if getKey throws an exception, arbitrary code may already have run. Successful exploitation is demonstrated by creation of /tmp/pwned. GET /exploit/cleanup removes the planted key file and proof artifact. This is a real exploit reproducer rather than a scanner or detection script. It does not autonomously attack remote targets; instead, it provides a controlled local/web interface to demonstrate the vulnerable behavior and prove RCE under the documented preconditions.