oscerd/cve-2026-80344Runnable proof-of-concept reproducer for CVE-2026-80344 in Apache Camel camel-as2, demonstrating asynchronous MDN SSRF and credential disclosure with affected and fixed builds.
Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the AS2 receiver delivered the
asynchronous Message Disposition Notification (MDN) to an address supplied by the sender (the
Receipt-Delivery-Option), with no constraint. A remote partner therefore chooses the host the Camel instance
connects to when delivering the MDN — server-side request forgery from the AS2 receiver's position, reaching hosts
only routable from inside the deployment's network — and where MDN delivery is configured with credentials, those
credentials are presented to the attacker-chosen destination.
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.5.13 + camel-as2 4.22.0 (affected; fixed 4.22.1) |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.29.0 + camel-quarkus-as2 3.29.0 (Camel 4.15.0, affected; fixed control 3.40.0 / Camel 4.22.1) |
The app runs, in one JVM:
as2://server/listen, port 8888) configured with MDN-delivery credentials;as2://client/send) that sends one unsigned (PLAIN) AS2 message requesting an
asynchronous MDN, with receiptDeliveryOption pointing at an internal-only URL (127.0.0.1:9099, a port
Docker does not publish — standing in for a host only reachable from inside the deployment);On the affected build the receiver connects to the attacker-chosen internal URL to deliver the MDN and
presents its MDN-delivery credentials (Authorization: Basic …) to it. On the fixed build those credentials
are withheld (they are attached only to allow-listed hosts), and the new asyncMdnAllowedHosts option restricts the
delivery host entirely.
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
Expected output on the affected build:
Internal host connections observed:
POST /internal-mdn-sink (Authorization=Basic bWRuLXBhcnRuZXItdXNlcjpNRE4tREVMSVZFUlktU0VDUkVU)
>>> PROVEN: the AS2 receiver connected to the sender-chosen internal URL to deliver the async MDN
>>> (server-side request forgery) AND presented its configured MDN-delivery credentials ...
(The Authorization value decodes to mdn-partner-user:MDN-DELIVERY-SECRET.) On the fixed build the connection
shows Authorization=null — the credentials are no longer presented to the sender-chosen host.
| Property | Value |
|---|---|
| Component | camel-as2 |
| CWE | CWE-918 (Server-Side Request Forgery); credential disclosure (CWE-200) |
| Severity | HIGH |
| Attack vector | An AS2 sender requesting an asynchronous MDN with an attacker-chosen Receipt-Delivery-Option address |
| Impact | Server-side request forgery from the receiver (reach internal hosts); disclosure of MDN-delivery credentials to the attacker-chosen host |
| Affected Versions | From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| Fixed Versions | 4.18.5, 4.22.1, 4.23.0 |
| JIRA | CAMEL-24417 |
| Credit | Claude Security Scan Tool |
Advisory: https://camel.apache.org/security/CVE-2026-80344.html
The asynchronous MDN destination is now constrained rather than taken verbatim from the inbound message. A new
asyncMdnAllowedHosts option (label security) allow-lists the hosts the MDN may be delivered to, and the
configured MDN-delivery credentials are attached only when the destination is allow-listed — so by default
(no allow-list) the credentials are never presented to a sender-chosen host.
Restrict outbound connectivity from the AS2 receiver to the partner endpoints it legitimately delivers receipts to, and do not attach credentials to MDN delivery that are valid for any host other than those partners.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The "credentials" and the internal sink are inert local fixtures. Do not use this material against systems you do not own or operate.