Apache Camel camel-vertx-http Unsafe Java Deserialization RCE

This repository is a self-contained Java/Spring Boot proof-of-concept for CVE-2026-40859, an unsafe deserialization issue in Apache Camel producer components camel-netty-http and camel-vertx-http. It is a real exploit reproducer, not just documentation or detection logic. Structure and purpose: Application.java is the Spring Boot entry point. VictimRoute.java defines the vulnerable Camel producer route from("direct:call") to netty-http://localhost:9999/evil?transferException=true, intentionally enabling the risky setting. MaliciousBackend.java implements an embedded attacker-controlled raw-socket HTTP server on port 9999 that always returns HTTP 500 with Content-Type: application/x-java-serialized-object and a serialized gadget body. Gadget.java constructs a CommonsCollections6-style gadget chain using commons-collections 3.2.1; when deserialized, it reaches Runtime.exec and runs /usr/bin/touch /tmp/pwned. ExploitController.java exposes /exploit/attack on port 8080, triggers the Camel route, catches the expected exception, and verifies exploitation by checking whether /tmp/pwned exists. The Dockerfile and docker-compose.yml package and expose the app for easy reproduction. Main exploit capability: remote code execution on the Camel host via malicious HTTP response deserialization. The exploit abuses the producer-side error-handling path: when the backend returns a non-2xx response and transferException=true, Camel deserializes the response body if the content type is application/x-java-serialized-object. Because gadget execution occurs during ObjectInputStream.readObject(), code runs before any instanceof Exception validation. In this PoC, the payload is hardcoded and simply creates /tmp/pwned as proof. Operational flow: a user requests /exploit/attack -> the controller invokes the direct:call Camel route -> the route contacts the malicious backend on localhost:9999 -> the backend returns a crafted serialized object in an HTTP 500 response -> Camel deserializes it and executes the gadget -> the controller reports success if /tmp/pwned exists. Targeting: affected Apache Camel versions are documented in the README and pom.xml uses camel-netty-http 4.18.2, which is within the vulnerable range. The exploit requires non-default configuration on the victim (transferException=true or allowJavaSerializedObject=true), default throwExceptionOnFailure=true, attacker control or interception of the backend response path, and a gadget library on the victim classpath. Overall maturity is OPERATIONAL: the exploit is complete and runnable, but the payload is fixed and tailored to demonstration rather than generalized weaponization.