Sploitus

Exploit for CVE-2026-49097

kitploit · 2026-08-25

Exploit Code

MARKDOWN21 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-49097
# camel-irc irc.sendTo Header Injection Reproducer (CVE-2026-49097)

This project demonstrates a **message-header injection** in Apache Camel's `camel-irc` component, tracked as **CVE-2026-49097**. `IrcProducer` reads the `irc.sendTo` header to choose the destination of the outgoing IRC message; when present it **overrides the endpoint's configured channel list** :

root@kitploit:~
    
    
    // IrcProducer.process (affected 4.18.2)
    final String sendTo = exchange.getIn().getHeader(IrcConstants.IRC_SEND_TO, String.class);  // "irc.sendTo"
    ...
    } else if (sendTo != null) {
        connection.doPrivmsg(sendTo, msg);          // attacker-chosen destination
    } else {
        for (IrcChannel channel : getEndpoint().getConfiguration().getChannelList()) {
            connection.doPrivmsg(channel.getName(), msg);   // the intended, configured channel(s)
        }
    }
    

The header constant `IRC_SEND_TO` has the plain value . Because it does not start with the  /  prefix,  — which blocks only the Camel header namespace at the HTTP boundary — lets it pass from an inbound HTTP request straight into the Exchange.