Apache Camel Undertow Stack Trace Information Disclosure

This repository is a self-contained Java/Spring Boot proof-of-concept reproducer for CVE-2026-56139, an information-disclosure flaw in Apache Camel's camel-undertow Rest DSL consumer. The project contains 10 files, with core logic in four Java classes under src/main/java/com/example. Application.java is the Spring Boot entry point. RestRoutes.java defines two Camel routes: a vulnerable undertow Rest DSL endpoint on port 8888 at /api/orders and a plain undertow endpoint on port 8889 at /plain/orders. Both routes invoke FailingProcessor.java, which deliberately throws an IllegalStateException containing sensitive-looking internal details (JDBC URL, internal hostname, service account hint, vault secret hint, backend IP) to simulate realistic leakage. ExploitController.java exposes /exploit/attack on port 8080 and acts as the attacker driver: it sends GET requests to both local endpoints, captures their HTTP 500 responses, and reports that the Rest DSL route leaks the full stack trace while the plain undertow route returns an empty body when muteException=true is honored. The repository also includes application.properties configuring server.port=8080 and camel.component.undertow.mute-exception=true, plus Dockerfile and docker-compose.yml for containerized reproduction. pom.xml pins camel-undertow-starter to vulnerable version 4.18.2. This is a real exploit/reproducer rather than a mere detector: it actively triggers the vulnerable behavior and demonstrates the resulting disclosure to an unauthenticated client. The exploit capability is limited to information exposure (CWE-209), not code execution. It is operational because it includes a working trigger path and hardcoded demonstration payload/data, but it is not weaponized or framework-based.