oscerd/cve-2026-48204Reproducer for CVE-2026-48204: Apache Camel camel-mongodb-gridfs gridfs.* header injection overriding the GridFS operation (enumerate/read/delete files) from an unauthenticated HTTP request (fixed in 4.14.8/4.18.3/4.21.0)
| Runtime | Directory | Stack |
|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.2.0 + camel-spring-boot 4.18.2 |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.36.0 + Camel Quarkus 3.36.0 (bundles Camel 4.20.0) |
Both are affected versions (fixed in 4.14.8 / 4.18.3 / 4.21.0), and both demonstrate the identical defect: when
the route sets no operation on the mongodb-gridfs endpoint, GridFsProducer takes the operation from the
gridfs.operation header. That header (and gridfs.objectid) is not in the Camel* namespace, so the HTTP
boundary filter does not strip it — an unauthenticated client of a file-upload endpoint switches the operation to
listAll (enumerate every file, leaking ObjectIds) or remove (delete a file by id) — CWE-20 / CWE-284.
Each subdirectory is a self-contained project (plus a MongoDB container started by its docker-compose.yml) with
its own Dockerfile and README. In short, for either:
cd camel-spring-boot # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
| Property | Value |
|---|---|
| Component | camel-mongodb-gridfs |
| Affected Class | org.apache.camel.component.mongodb.gridfs.GridFsProducer (operation from gridfs.operation when endpoint operation unset) |
| CWE | CWE-20 (Improper Input Validation) / CWE-284 (Improper Access Control) |
| Impact | Override the GridFS operation via headers → enumerate / read / delete files; gridfs.metadata NoSQL injection |
| Affected Versions | From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0 |
| Fixed Versions | 4.14.8, 4.18.3, 4.21.0 |
| JIRA | CAMEL-23575 (PR apache/camel#23413) |
| Credit | Yu Bao (PayPal) |
These reproducers are provided for security research and authorized testing only, for a publicly disclosed and fixed vulnerability. Do not use them against systems without explicit permission.