Apache Camel camel-hazelcast Unsafe Java Deserialization RCE

This repository is a self-contained Java/Spring Boot proof-of-concept reproducer for CVE-2026-43865, an unsafe deserialization vulnerability in Apache Camel's camel-hazelcast component when Camel creates the Hazelcast instance from its default configuration without a deserialization filter. The project contains a victim Camel route and an attacker component in the same application. Structure and purpose: Application.java is the Spring Boot entry point. VictimRoute.java defines the vulnerable Camel consumer route from hazelcast-queue:cve?queueConsumerMode=Poll, intentionally relying on Camel's default Hazelcast instance creation path. ExploitController.java exposes a GET endpoint /exploit/attack that acts as the attacker: it creates a Hazelcast client, joins cluster name 'dev' at 127.0.0.1:5701, and offers a serialized gadget object into queue 'cve'. Gadget.java constructs a CommonsCollections6-style gadget chain using commons-collections 3.2.1 and reflection into java.util internals; on deserialization it executes /usr/bin/touch /tmp/pwned. application.properties sets the web server to port 8080. Dockerfile and docker-compose.yml package and run the demo in a containerized single-node environment. Main exploit capability: remote code execution via network-reachable Hazelcast cluster deserialization. The exploit does not merely detect the issue; it actively sends a malicious serialized object that is deserialized by the victim's Hazelcast queue consumer before Camel processes it. The PoC verifies success by checking for /tmp/pwned. Operational flow: an operator calls the HTTP endpoint /exploit/attack, which resets any prior proof file, builds the gadget payload, connects to the Hazelcast member as a client, submits the object to the queue, waits briefly for deserialization-triggered execution, and returns whether the proof file exists. This makes the repository both a vulnerable service and an exploit launcher for demonstration purposes.