Apache Camel Case-Variant Internal Header Injection

This repository is a functional Java/Spring Boot proof-of-concept reproducer for CVE-2026-40453 in Apache Camel. It is not just documentation: it contains a runnable vulnerable route, a bundled attacker client, Docker packaging, and clear exploit paths. The exploit demonstrates that Camel non-HTTP header filter strategies can be bypassed with case-variant Camel* header names because filtering is case-sensitive while the Camel Exchange header map is case-insensitive. Repository structure: Application.java is the Spring Boot entry point. CoapExecRoute.java defines the vulnerable Camel route from coap://0.0.0.0:5683/run to exec:echo?args=hello, making camel-exec the RCE sink. ExploitController.java exposes HTTP helper endpoints under /exploit that send CoAP requests to the local route: /normal sends no injected headers, /canonical sends CamelExecCommandExecutable and CamelExecCommandArgs as a control case, and /attack sends the bypass payload using CAmelExecCommandExecutable and CAmelExecCommandArgs. application.properties sets server.port=8080. Dockerfile and docker-compose.yml package and expose the app. Main exploit capability: remote command execution through header injection. The attack works by supplying CoAP URI query parameters that become Camel headers. Canonical CamelExecCommand* headers are filtered, but case-variant forms such as CAmelExecCommandExecutable bypass the vulnerable CoAPHeaderFilterStrategy and are later resolved by camel-exec under the canonical header names. In this PoC, the payload changes the executed command to /usr/bin/touch /tmp/pwned, proving code execution inside the container. The repository also demonstrates the negative case where /tmp/pwned-canonical should not be created. Operationally, this is an exploit reproducer rather than a generalized weaponized tool. It requires a vulnerable Camel deployment pattern: an untrusted producer (here camel-coap) feeding a header-sensitive downstream component (here camel-exec). The code is concise, self-contained, and purpose-built to validate the vulnerability and show exploitability.