## https://sploitus.com/exploit?id=44377D35-2101-5145-83CD-48B18567CE80
# CVE-2026-71300 — camel-atmosphere-websocket dispatch header injection
Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-atmosphere-websocket
producer selects its WebSocket recipients from `websocket.*` Exchange headers whose names fall **outside** the
`Camel` namespace — so an HTTP `HeaderFilterStrategy` (which strips only `Camel*` / `camel*`) admits them, and an
external sender can take over the producer's dispatch decision.
| Runtime | Directory | Stack |
|---------|-----------|-------|
| **Camel Spring Boot** | [`camel-spring-boot/`](camel-spring-boot/) | Spring Boot 3.5.13 + camel-atmosphere-websocket **4.18.2** |
> **Camel Quarkus:** there is no `camel-quarkus-atmosphere-websocket` extension, so this component cannot be run on
> Camel Quarkus — the reproducer is Spring Boot only.
## What it demonstrates
A route bridges an HTTP consumer into an atmosphere-websocket producer, delivering each HTTP message to a single
pinned WebSocket recipient (the "victim") by setting the `websocket.connectionKey` header itself. But
`WebsocketProducer.process` tests the **list** header `websocket.connectionKey.list` *before* the single-key
header, and that dotted name is not in the `Camel` namespace, so the HTTP header filter does not strip it. An
injected `websocket.connectionKey.list` header therefore passes from the request into the Exchange and overrides
the pinned recipient — the message meant for the victim is delivered to an attacker-chosen connection instead.
```
POST /notify ──► setHeader(websocket.connectionKey = victim) ──► atmosphere-websocket producer ──► victim peer
│ ▲
└─ injected header websocket.connectionKey.list: ───────┘ (tested first → wins)
```
> **On the test harness.** The atmosphere WebSocket runtime needs the servlet container's WebSocket upgrade and
> the framework's own initialization, which cannot be driven from a plain standalone Spring Boot app. This
> reproducer therefore exercises the **real `WebsocketProducer` dispatch logic over a real HTTP ingress** — only
> the two connected peers are stand-ins registered directly into the endpoint's `WebSocketStore` (as the atmosphere
> framework would register real browser connections). The header-filter bypass and the producer's dispatch
> precedence — the actual vulnerability — are exercised for real.
```bash
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
```
Expected output on an affected build:
```
1) Benign POST /notify (no injected header):
victim received: [hello for the victim]
attacker received: []
2) Injected POST /notify with header 'websocket.connectionKey.list: attacker-connection-key':
victim received: []
attacker received: [private data meant for the victim, ...]
>>> PROVEN: ... delivering a message meant for the victim to an attacker-chosen WebSocket connection instead: true
```
## Vulnerability Summary
| Property | Value |
|----------|-------|
| **Component** | `camel-atmosphere-websocket` (`camel-atmosphere-websocket-starter`) |
| **CWE** | CWE-20 (Improper Input Validation) → CWE-74 (Injection) |
| **Attack vector** | An injected `websocket.connectionKey.list` (or `websocket.connectionKey` / `websocket.sendToAll`) header on a request bridged into an atmosphere-websocket producer |
| **Impact** | Take over the producer's dispatch decision — deliver to / withhold from arbitrary WebSocket peers |
| **Affected Versions** | From 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0 |
| **Fixed Versions** | 4.14.9, 4.18.4, 4.22.0 |
| **JIRA** | [CAMEL-24359](https://issues.apache.org/jira/browse/CAMEL-24359) |
| **Credit** | Barak Srour (Apiiro) |
Advisory: https://camel.apache.org/security/CVE-2026-71300.html
## The fix
The dispatch header constants were renamed into the `Camel` namespace — `CamelAtmosphereWebsocketConnectionKey`,
`CamelAtmosphereWebsocketConnectionKeyList`, `CamelAtmosphereWebsocketSendToAll` — so the HTTP `HeaderFilterStrategy`
strips them at the transport boundary and an external sender can no longer inject them. The related
`camel-undertow` websocket path is covered by
[CVE-2026-78329](https://camel.apache.org/security/CVE-2026-78329.html).
## Disclaimer
This repository is published for educational and defensive purposes: to help Apache Camel users understand the
vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material
against systems you do not own or operate.