Sploitus

Exploit for CVE-2026-55993

kitploit · 2026-08-25

Exploit Code

MARKDOWN16 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-55993
# camel-atmosphere-websocket Header Injection Reproducer (CVE-2026-55993)

This project demonstrates a **message-header injection** in Apache Camel's `camel-atmosphere-websocket` component, tracked as **CVE-2026-55993**. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange **without any`HeaderFilterStrategy`**, so a client can inject Camel control headers — notably `CamelHttpUri` — simply by adding them to the WebSocket URL's query string:

root@kitploit:~
    
    
    // WebsocketConsumer.sendEventNotification (affected 4.18.2) — query params -> Exchange headers, unfiltered
    for (Map.Entry<String, String> param : queryMap.entrySet()) {
        exchange.getIn().setHeader(param.getKey(), param.getValue());
    }
    // where queryMap = getQueryMap(request.getQueryString())  (a naive, non-filtering parser)
    

When the route bridges this consumer into an HTTP producer, an injected `CamelHttpUri` **overrides the producer's target URI** — server-side request forgery. The camel-http producer also calls  on that attacker-controlled URI, so an injected  reference is expanded to its real value and sent out — disclosing environment variables, application properties, or vault secrets.