Apache Camel JMS ObjectMessage Unsafe Deserialization RCE

This repository is a working Java/Spring Boot proof-of-concept for CVE-2026-43866, a bypass of Apache Camel’s earlier CVE-2026-40860 deserialization filtering in JMS-family components. It is not a framework module; it is a standalone reproducer composed of a Spring Boot app, Camel JMS route, attacker controller, and Dockerized ActiveMQ Artemis broker. Structure and purpose: Application.java is the Spring Boot entry point. JmsConfig.java configures an ActiveMQConnectionFactory with broker credentials and a realistic trusted package allow-list (java, javax, org.apache.camel), then exposes a Camel jms component. VictimRoute.java defines the vulnerable consumer route from("jms:queue:cve") and records the body/header/property actually observed by the route. CapturedState.java stores those observed values for later reporting. ForgedHolderFactory.java creates the malicious payload by constructing a Camel Exchange and marshaling it into a DefaultExchangeHolder using Camel’s public API. ExploitController.java exposes GET /exploit/attack, which generates a marker, builds the forged holder, opens a JMS connection, sends it as an ObjectMessage to queue cve, waits for the victim route to consume it, and returns a textual proof showing whether body/header/property injection succeeded. Dockerfile and docker-compose.yml package the app and launch an Artemis broker plus the reproducer service. Main exploit capability: the exploit does not attempt code execution. Instead, it performs Exchange-state injection by abusing the fact that a top-level org.apache.camel.support.DefaultExchangeHolder passes Camel’s post-deserialization allow-list and is then unmarshaled into the receiving Exchange. The payload uses only trusted java.* values plus the Camel holder object itself, so no gadget chain is required. The demonstrated impact is attacker control over the routed Exchange body, headers, and properties; the README notes that variables, exchange id, and exception can also be influenced. Operational flow: an operator calls the HTTP endpoint /exploit/attack on port 8080. The app then publishes a JMS ObjectMessage to the cve queue on the Artemis broker at tcp://artemis:61616 (or tcp://localhost:61616 outside Docker). The victim Camel consumer receives from jms:queue:cve and unmarshals the forged holder before route processing, proving the bypass. Overall, this is a valid exploit PoC with a hardcoded but functional payload, intended to reproduce and demonstrate the vulnerability against affected Apache Camel JMS consumers.

This repository is a working Java/Spring Boot proof-of-concept reproducer for CVE-2026-40860, an unsafe deserialization issue in Apache Camel's JMS consumer path. The project contains both sides of the demonstration: an attacker-facing HTTP controller that publishes a crafted JMS ObjectMessage, and a victim Camel route that consumes from a JMS queue and triggers ObjectMessage.getObject() during message mapping. Repository structure is small and focused: Application.java is the Spring Boot entry point; JmsConfig.java configures an ActiveMQ OpenWire ConnectionFactory with trustAllPackages=true and exposes Camel's jms component; VictimRoute.java defines the vulnerable consumer route from("jms:queue:evil"); ExploitController.java exposes GET /exploit/attack, builds the malicious object, sends it to the queue, and waits for proof of execution; Gadget.java constructs a CommonsCollections6-style deserialization gadget that executes /usr/bin/touch /tmp/pwned during readObject(). Supporting files include pom.xml with vulnerable Camel 4.18.1 and commons-collections 3.2.1, docker-compose.yml for an Artemis broker and app container, Dockerfile, and application.properties. Main exploit capability: remote code execution via network-accessible JMS message injection. The attacker only needs the ability to publish a crafted ObjectMessage to a destination consumed by an affected Camel JMS route. In this PoC, exploitation is triggered indirectly over HTTP by calling /exploit/attack, which causes the app to act as the producer and send the malicious message to queue 'evil'. The actual vulnerability is exercised when the Camel consumer asynchronously receives that message and deserializes it. Notable targets and observables include the HTTP trigger endpoint on port 8080, the JMS broker on tcp://localhost:61616 or tcp://artemis:61616, the Camel destination jms:queue:evil, Artemis console port 8161, and the proof file /tmp/pwned. This is clearly exploit code rather than a detector, and while the payload is hardcoded and basic, it is functional, making the maturity OPERATIONAL rather than a mere conceptual PoC.