oscerd
Source-scoped identity with 48 associated PoCs and 49 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
GitHuboscerd/CVE-2026-64640
Repository PoCStars: 0Created 2026-08-07ExploitCVE-2026-6464065 files
Analysis
Technical assessment
A self-contained, one-command reproducer for CVE-2026-64640 in Apache Polaris. The script (exploit.sh) brings up a local Polaris + S3 stack, authenticates as a low-privilege principal, and sends crafted requests to the Iceberg REST `register` and `register-view` endpoints. It demonstrates that Polaris vends storage credentials and performs a server-side read of an attacker-controlled location outside the catalog's allowedLocations before validating the location, leaking information from the read object back to the caller.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a proof-of-concept (PoC) exploit for CVE-2026-64640 in Apache Polaris. The supplied files (Makefile, README.md, exploit.sh) describe and implement a self-contained, local-only reproduction of the vulnerability. The exploit.sh script orchestrates a Docker Compose environment, authenticates as a low-privilege user, and sends crafted HTTP requests to the Polaris API to demonstrate that the server reads an out-of-scope storage object before validating its location. The script's behavior is entirely directed at the stated target (Apache Polaris) and performs no actions outside the local test environment. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a fully automated script (exploit.sh) that exercises the vulnerability by sending crafted requests to a live Polaris instance, causing it to perform a privileged server-side read of an out-of-scope object and leak information. The README explicitly describes it as a 'reproducer' and the Makefile target is named 'exploit'. The script's primary purpose is to demonstrate the vulnerability, not merely detect it.
exploit.sh:1-11Makefile:6-8README.md:3-6Requirements
- An authenticated principal with CATALOG_MANAGE_CONTENT or TABLE_CREATE privilege on a catalog.
README.md:8-11 - A deployment using S3 credential vending where the catalog's underlying storage credentials can read an object outside the allowed locations.
README.md:55-57
Observed behavior
- Authenticates as a low-privilege principal and confirms non-admin status.
exploit.sh:137-153 - Sends a register request with a metadata-location pointing to an out-of-scope S3 object. The response contains a canary string that exists only inside that object, proving Polaris read and parsed it server-side.
exploit.sh:195-207 - Probes for missing keys, non-existent buckets, and non-Iceberg objects outside allowedLocations, receiving distinguishable storage-level errors, demonstrating a storage enumeration oracle.
exploit.sh:230-261 - Sends a register-view request with an out-of-scope view metadata location. On vulnerable versions, the response contains a view-specific canary, proving the same flaw exists on the view registration endpoint.
exploit.sh:276-301 - Exits with code 0 if the vulnerability is reproduced, 1 if not, and 2 on setup error.
exploit.sh:17-21
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe exploit.sh script (lines 138-301) performs authentication and sends crafted register/register-view requests to a local Polaris API. This is the expected behavior for a PoC demonstrating the described vulnerability.
exploit.sh:138-301 - Environment Management
- Payload withheldThe script (lines 115-128) starts and stops a Docker Compose stack with Polaris and a local S3 mock. This is standard for a self-contained PoC and does not indicate malicious intent.
exploit.sh:115-128 - Evidence Collection
- Payload withheldThe script (lines 80-81, 161-172, 186, 220, 273, 287, 342) saves HTTP responses and a summary JSON to an evidence/ directory. This is consistent with a PoC that documents its results.
exploit.sh:80-81exploit.sh:161-172
What the analysis did not establish
- Only 3 of 65 files in the repository were provided as text; the remaining 62 files (including scripts, victim data, and documentation) were omitted due to size constraints.
- The evidence does not include the actual execution output of the exploit script, only its source code and documentation.
- Only 3 of 65 files in the repository were provided as readable text; the remaining 62 files (including binary files, scripts, and configuration) were not analyzed. The review covers only the supplied evidence.
- The exploit.sh script sources an external script (scripts/lib.sh) which was not included in the evidence. The behavior of that sourced script is unknown.
- The PoC uses Docker images (apache/polaris) pulled from a public registry; the content of those images was not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-56139
Repository PoCStars: 0Created 2026-07-22ScannerCVE-2026-5613910 files
Analysis
Technical assessment
The artifact is a scanner that checks for CVE-2026-56139 by sending HTTP requests to a vulnerable Apache Camel Undertow Rest DSL endpoint and a plain Undertow endpoint, then comparing the responses to determine if the Rest DSL endpoint leaks a stack trace despite muteException=true being configured.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a Dockerfile, README, Maven POM, and a single Java controller class for a publicly disclosed CVE-2026-56139 proof-of-concept. The code demonstrates an information-disclosure vulnerability in Apache Camel's Undertow component by making HTTP requests to local vulnerable endpoints and comparing responses. No concealed executable behavior, persistence, credential exfiltration, or unrelated payloads are present. The artifact's behavior is limited to demonstrating the described CVE.
Classification basis and observed behavior
Classification basis
The primary artifact is the ExploitController.java class, which acts as an 'attacker driver' that probes endpoints and reports whether sensitive information is disclosed. It does not exploit the vulnerability to gain unauthorized access or execute commands; it only validates the presence of the information disclosure by checking response content. This is consistent with a scanner.
src/main/java/com/example/ExploitController.java:13-17src/main/java/com/example/ExploitController.java:24-52Requirements
- A running instance of the vulnerable application with the Rest DSL and plain Undertow endpoints exposed.
README.md:80-87
Observed behavior
- Sends an HTTP GET request to the Rest DSL endpoint (port 8888) and the plain Undertow endpoint (port 8889).
src/main/java/com/example/ExploitController.java:30-31 - Checks if the response from the Rest DSL endpoint contains a sensitive marker string (a database URL) and if the plain endpoint response does not.
src/main/java/com/example/ExploitController.java:39-40 - Reports whether the vulnerability is present based on the presence of the marker in the Rest DSL response and its absence in the plain endpoint response.
src/main/java/com/example/ExploitController.java:42-50
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core PoC logic; it probes the vulnerable Rest DSL and plain Undertow endpoints to demonstrate the CVE-2026-56139 information disclosure.
src/main/java/com/example/ExploitController.java:30-31 - Sensitive Data Marker
- Payload withheldUsed as a marker to detect whether the stack trace leaked internal database connection details, consistent with the CVE description.
src/main/java/com/example/ExploitController.java:22 - Affected Component
- Payload withheldThe POM declares the vulnerable version of the Camel Undertow component, matching the CVE-affected range.
pom.xml:20
What the analysis did not establish
- Only 4 of 10 files in the repository were provided as text evidence. The remaining 6 files (including Application.java, FailingProcessor.java, RestRoutes.java, application.properties, and docker-compose.yml) are omitted, so the full application logic and configuration cannot be verified.
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository are included in the analysis.
- Six files from the repository (total 10) were omitted from the text evidence; their content is unknown. The analysis scope reports these as unclassified files totaling 3102 bytes, but their nature (e.g., other Java classes, configuration files) is not provided.
- The evidence does not include the complete source code for the vulnerable application (e.g., FailingProcessor.java, RestRoutes.java, Application.java), only the attacker driver class. The behavior of the full application when built and run cannot be confirmed from the supplied text alone.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-55994
Repository PoCStars: 0Created 2026-07-22ExploitCVE-2026-5599410 files
Analysis
Technical assessment
The artifact is a self-contained Java application that directly invokes the vulnerable IggyFetchRecords.createExchange method with forged Iggy messages containing attacker-controlled headers (CamelHttpUri). It then routes the resulting poisoned Exchange through a real Camel HTTP producer, demonstrating SSRF and secret disclosure via property placeholder resolution.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a proof-of-concept (PoC) for CVE-2026-55994, a publicly disclosed vulnerability in Apache Camel's camel-iggy component. The PoC demonstrates the vulnerability by forging an Iggy message with a malicious CamelHttpUri header and routing it through the real vulnerable code to an HTTP producer, resulting in SSRF and secret disclosure. All code and documentation are consistent with this stated purpose. No concealed executable behavior, persistence, credential theft, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The ExploitController.java code actively exercises the vulnerability by forging malicious Iggy messages, invoking the vulnerable createExchange method, and routing the result to trigger SSRF and secret disclosure. This is exploit code, not merely a scanner or writeup.
src/main/java/com/example/ExploitController.java:59-110Requirements
- A route bridges an iggy: consumer into an HTTP producer; attacker can publish to the consumed topic (simulated by direct invocation).
README.md:37 - The vulnerable version of camel-iggy (4.18.2) is used, which copies user-headers to the Exchange without a HeaderFilterStrategy.
pom.xml:20
Observed behavior
- Constructs a real IggyFetchRecords instance and uses reflection to invoke its private createExchange method with a forged Iggy message.
src/main/java/com/example/ExploitController.java:63-69 - Injects a CamelHttpUri header pointing to an internal endpoint (/internal/secret) to perform SSRF.
src/main/java/com/example/ExploitController.java:85 - Injects a CamelHttpUri header containing a Camel property placeholder ({{app.secret}}) to exfiltrate a resolved secret to an attacker-controlled collector.
src/main/java/com/example/ExploitController.java:93 - Routes the poisoned Exchange through a real Camel HTTP producer via direct:iggy-delivery.
src/main/java/com/example/ExploitController.java:115
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the normal exploit behavior for CVE-2026-55994 and does not constitute a backdoor.
src/main/java/com/example/ExploitController.java:85-93README.md:46-57 - Self Contained Application
- Payload withheldThis is consistent with a portable PoC and does not indicate hidden behavior.
Dockerfile:5-9
What the analysis did not establish
- Only 4 of 10 files in the repository are included as text evidence; the remaining 6 files (including Application.java, VictimRoute.java, SinkController.java, application.properties, docker-compose.yml) are omitted, limiting full verification of the exploit chain.
- The evidence packet reports complete_artifact_coverage as false, indicating not all artifact content was analyzed.
- 6 out of 10 files in the repository were omitted from the evidence packet. The omitted files likely include application.properties, VictimRoute.java, SinkController.java, and docker-compose.yml, which are referenced in the provided files and are consistent with the PoC's stated purpose. Their absence does not raise suspicion, but they were not reviewed.
- Binary files were not analyzed (binary_policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED), but no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-55993
Repository PoCStars: 0Created 2026-07-22ExploitCVE-2026-5599310 files
Analysis
Technical assessment
The artifact is a self-contained Java application that directly invokes the vulnerable methods of Apache Camel's camel-atmosphere-websocket component to demonstrate SSRF and secret disclosure. It uses reflection to call the real, unmodified WebsocketConsumer.getQueryMap() and sendEventNotification() with attacker-controlled query strings, causing the downstream HTTP producer to make requests to attacker-chosen URLs and leak resolved property placeholders.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a legitimate proof-of-concept (PoC) for CVE-2026-55993, a publicly disclosed vulnerability in Apache Camel's camel-atmosphere-websocket component. The PoC demonstrates the vulnerability by invoking the real, vulnerable methods of the affected library (WebsocketConsumer.getQueryMap and sendEventNotification) with attacker-controlled query strings to trigger SSRF and secret disclosure. All code is consistent with the stated purpose of demonstrating the CVE; no concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed. The artifact does not attempt to deceive the operator or perform any action beyond demonstrating the described vulnerability.
Classification basis and observed behavior
Classification basis
The code actively exercises the vulnerability by directly invoking the real vulnerable methods with crafted input to achieve SSRF and secret disclosure, which constitutes exploitation rather than mere detection or analysis.
src/main/java/com/example/ExploitController.java:48-98README.md:44-54Requirements
- A route bridges an atmosphere-websocket consumer into an HTTP producer; the servlet runs with events=true
README.md:35 - The vulnerable version of camel-atmosphere-websocket (4.18.2) is used
pom.xml:20
Observed behavior
- Uses reflection to access the private getQueryMap method and queryMap field of WebsocketConsumer
src/main/java/com/example/ExploitController.java:53-56 - Sets the consumer's queryMap with an attacker-controlled query string containing CamelHttpUri header
src/main/java/com/example/ExploitController.java:107-108 - Calls the real sendEventNotification method to trigger the vulnerable header-copy path
src/main/java/com/example/ExploitController.java:110 - Injects CamelHttpUri to redirect the HTTP producer to /internal/secret, demonstrating SSRF
src/main/java/com/example/ExploitController.java:73 - Injects CamelHttpUri with a property placeholder {{app.secret}} to leak the resolved secret value
src/main/java/com/example/ExploitController.java:81
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThe PoC uses reflection to call the vulnerable library methods with attacker-controlled query strings, triggering SSRF and secret disclosure as described in the CVE advisory.
src/main/java/com/example/ExploitController.java:53-56src/main/java/com/example/ExploitController.java:73src/main/java/com/example/ExploitController.java:81 - Target Behavior
- Payload withheldThe PoC demonstrates the exact impact described in CVE-2026-55993: redirecting an HTTP request to an internal endpoint and leaking a resolved property placeholder.
README.md:16-19src/main/java/com/example/ExploitController.java:72-86
What the analysis did not establish
- Only 4 of 10 text files are included; the remaining 6 files (including Application.java, VictimRoute.java, SinkController.java, application.properties, docker-compose.yml) are omitted, limiting full verification of the exploit chain.
- The artifact does not use a live WebSocket connection; it directly invokes vulnerable methods via reflection, which may not represent a real-world attack vector as noted in the README.
- 6 of 10 files in the repository were not included as text evidence; their content was not reviewed. Based on file metadata, these are likely standard supporting files (e.g., Application.java, VictimRoute.java, SinkController.java, application.properties, docker-compose.yml) that are consistent with the PoC's described structure and purpose.
- No binary files were identified for analysis.
- The review is limited to static analysis of the provided text; the artifact was not executed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-53913
Repository PoCStars: 1Created 2026-07-21ExploitCVE-2026-5391320 files
Analysis
Technical assessment
The artifact contains two self-contained Java projects (Camel Spring Boot and Camel Quarkus) that demonstrate an authentication bypass vulnerability (CVE-2026-53913) in Apache Camel Keycloak. Each project includes an attacker driver that sends HTTP requests with a missing token, a garbage token, and a forged unsigned JWT to a protected admin endpoint. The code checks whether the protected route's code-execution sink is reached, proving unauthenticated remote code execution when the default (empty) role/permission configuration is used.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and two Java exploit driver classes for CVE-2026-53913. The code demonstrates the publicly disclosed authentication bypass by sending crafted HTTP requests to a locally running vulnerable Camel application. It does not contain any concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads. All actions are consistent with a legitimate proof-of-concept for the stated vulnerability.
Classification basis and observed behavior
Classification basis
The code actively sends crafted HTTP requests to a vulnerable endpoint to bypass authentication and trigger a code-execution sink (exec component or equivalent processor). It verifies successful exploitation by checking for side effects of code execution (e.g., 'uid=' in response, payload withheld file). This is exploitation, not mere detection or scanning.
README.md:3README.md:10-15camel-quarkus/src/main/java/com/example/ExploitResource.java:15-18camel-spring-boot/src/main/java/com/example/ExploitController.java:15-18Requirements
- A running instance of the vulnerable Camel application with the KeycloakSecurityPolicy configured with default (empty) requiredRoles and requiredPermissions.
README.md:11-12
Observed behavior
- Sends an HTTP POST request with no Authorization header to the protected /admin/run endpoint and expects it to be rejected.
camel-quarkus/src/main/java/com/example/ExploitResource.java:39-41camel-spring-boot/src/main/java/com/example/ExploitController.java:39-41 - Sends an HTTP POST request with a garbage Authorization header (Bearer x) and verifies that the protected route's code-execution sink is reached (e.g., by checking for 'uid=' in the response or the presence of payload withheld).
camel-quarkus/src/main/java/com/example/ExploitResource.java:43-46camel-spring-boot/src/main/java/com/example/ExploitController.java:44-47 - Sends an HTTP POST request with a forged, unsigned JWT (alg: none) and verifies that the protected route's code-execution sink is reached.
camel-quarkus/src/main/java/com/example/ExploitResource.java:48-51camel-spring-boot/src/main/java/com/example/ExploitController.java:50-53 - Determines that the vulnerability is exploitable if the garbage and forged tokens bypass authentication but the missing token is rejected.
camel-quarkus/src/main/java/com/example/ExploitResource.java:53-54camel-spring-boot/src/main/java/com/example/ExploitController.java:55-56
Behaviors behind the backdoor verdict
Observables
- Forged Jwt
- Payload withheldA hardcoded unsigned JWT used to demonstrate the authentication bypass; it is sent to the local application under test, not to an external service.
camel-quarkus/src/main/java/com/example/ExploitResource.java:26-28camel-spring-boot/src/main/java/com/example/ExploitController.java:27-29 - Http Request Target
- Payload withheldThe exploit drivers send POST requests to this local endpoint to trigger the vulnerable route. This is the expected target for a PoC demonstrating the CVE.
camel-quarkus/src/main/java/com/example/ExploitResource.java:71camel-spring-boot/src/main/java/com/example/ExploitController.java:75 - File Write Marker
- Payload withheldThe Spring Boot variant checks for the existence of this file to confirm code execution. The file is created by the vulnerable route, not by the exploit driver itself.
camel-spring-boot/src/main/java/com/example/ExploitController.java:24
What the analysis did not establish
- Only 3 of 20 files in the repository were provided as text; the remaining 17 files (including build files, route definitions, and Docker configurations) were omitted.
- The evidence does not include the actual execution output, so the exploit's success is based solely on the code's stated intent.
- 17 text files in the repository were not included in the evidence packet and were not reviewed.
- No binary files were analyzed; the packet metadata indicates 17 unclassified files totaling 26147 bytes were omitted.
- The review is based solely on static source code analysis; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-49365
Repository PoCStars: 0Created 2026-07-21ScannerCVE-2026-4936519 files
Analysis
Technical assessment
The artifact contains two self-contained Java applications (Spring Boot and Quarkus) that probe local Camel HTTP endpoints to check whether the default muteException=false setting causes full Java stack traces to be returned in HTTP response bodies. The code sends HTTP GET requests, inspects the responses for a known secret marker, and reports whether information disclosure occurred. It does not exploit the vulnerability to gain unauthorized access or extract data beyond what the server voluntarily returns; it only validates the presence of the information leak.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and two Java source files that implement a proof-of-concept for CVE-2026-49365. The code sends HTTP requests to local endpoints and checks whether the response body contains a stack trace with a known secret marker, which is the expected behavior for demonstrating the disclosed vulnerability. No concealed executable behavior, persistence, credential exfiltration, or unrelated payloads were observed. The artifact is a straightforward, self-contained reproducer for a publicly disclosed and fixed CVE.
Classification basis and observed behavior
Classification basis
The code only sends HTTP requests to local endpoints and inspects the response for a known secret string to determine if a stack trace is disclosed. It does not perform any action to compromise the target, extract data beyond the response body, or establish persistence. This is consistent with a scanner that validates the presence of a vulnerability.
camel-spring-boot/src/main/java/com/example/ExploitController.java:31-33camel-spring-boot/src/main/java/com/example/ExploitController.java:44-45camel-spring-boot/src/main/java/com/example/ExploitController.java:47-55Requirements
- A running instance of the vulnerable Camel application with the /api/orders endpoint exposed on localhost ports 8888, 8889, 8890.
camel-spring-boot/src/main/java/com/example/ExploitController.java:31-33
Observed behavior
- Sends HTTP GET requests to local Camel endpoints and checks if the response body contains a secret marker (jdbc:postgresql://prod-db.internal) indicating a stack trace leak.
camel-spring-boot/src/main/java/com/example/ExploitController.java:31-33camel-spring-boot/src/main/java/com/example/ExploitController.java:44-45 - Prints a diagnostic message indicating whether the vulnerability was reproduced (stack trace leaked) or not.
camel-spring-boot/src/main/java/com/example/ExploitController.java:47-55
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the normal exploit behavior for CVE-2026-49365, which involves information disclosure via error messages.
camel-quarkus/src/main/java/com/example/ExploitResource.java:35-36camel-quarkus/src/main/java/com/example/ExploitResource.java:44-45camel-spring-boot/src/main/java/com/example/ExploitController.java:31-33camel-spring-boot/src/main/java/com/example/ExploitController.java:44-45 - Disclaimer
- Payload withheldThis indicates the author's stated intent and aligns with the observed behavior.
README.md:41-44
What the analysis did not establish
- Only 3 of 19 files in the repository were provided as readable text; the remaining 16 files (including Dockerfiles, POM files, and route definitions) were omitted.
- The evidence does not include the actual server-side route implementations that throw the exception, so the full exploit chain cannot be verified.
- The analysis is based solely on static code review; the code was not executed, and its behavior in a live environment is not confirmed.
- Only 3 of 19 files in the repository were provided as text; the remaining 16 files (including build files, configuration, and other source files) were omitted from the evidence packet. The analysis is limited to the supplied text content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-49099
Repository PoCStars: 0Created 2026-07-21ExploitCVE-2026-4909923 files
Analysis
Technical assessment
The artifact contains two self-contained Java applications (Spring Boot and Quarkus) that act as attacker drivers. They send HTTP requests to a local vulnerable Camel route, injecting an 'payload withheld' header to override the route's intended SOQL query, thereby demonstrating a SOQL injection and authorization bypass (CVE-2026-49099).
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and two Java exploit driver classes for CVE-2026-49099. The code demonstrates the publicly disclosed vulnerability by sending an HTTP request with an 'payload withheld' header to a local test endpoint and recording the resulting SOQL query. No concealed executable behavior, persistence, credential theft, unrelated payload, or operator-directed harm is present. The artifact is a standard proof-of-concept reproducer for a known, fixed vulnerability.
Classification basis and observed behavior
Classification basis
The code actively sends a crafted HTTP request with a malicious header to a vulnerable endpoint to trigger the vulnerability and verify its success, which is the definition of an exploit. It does not merely check for the vulnerability's presence (scanner) or describe it (writeup).
camel-quarkus/src/main/java/com/example/ExploitResource.java:46-48camel-quarkus/src/main/java/com/example/ExploitResource.java:51-57camel-spring-boot/src/main/java/com/example/ExploitController.java:45-47camel-spring-boot/src/main/java/com/example/ExploitController.java:50-56Requirements
- A running instance of the vulnerable Camel application (provided in the artifact) with an HTTP consumer bridging to a salesforce: producer.
README.md:10-15 - The attacker must be able to send HTTP requests to the vulnerable application's endpoint.
camel-quarkus/src/main/java/com/example/ExploitResource.java:68-69
Observed behavior
- Sends an HTTP POST request to /contacts with a malicious 'payload withheld' header to override the route's configured SOQL query.
camel-quarkus/src/main/java/com/example/ExploitResource.java:68-74camel-spring-boot/src/main/java/com/example/ExploitController.java:67-73 - Compares the executed SOQL query from a legitimate request and an injected request to determine if the header injection was successful.
camel-quarkus/src/main/java/com/example/ExploitResource.java:41-61camel-spring-boot/src/main/java/com/example/ExploitController.java:40-60 - Outputs a message indicating whether the vulnerability was successfully exploited.
camel-quarkus/src/main/java/com/example/ExploitResource.java:53-57camel-spring-boot/src/main/java/com/example/ExploitController.java:52-56
Behaviors behind the backdoor verdict
Observables
- HTTP Header Injection
- Payload withheldThe PoC sends an HTTP request with the header 'payload withheld' to demonstrate the CVE-2026-49099 header injection vulnerability.
camel-quarkus/src/main/java/com/example/ExploitResource.java:72camel-spring-boot/src/main/java/com/example/ExploitController.java:71 - Local HTTP Request
- Payload withheldThe PoC makes requests to a local test server, not an external attacker-controlled endpoint.
camel-quarkus/src/main/java/com/example/ExploitResource.java:69camel-spring-boot/src/main/java/com/example/ExploitController.java:68
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository were provided. Only 3 of 23 text files are included.
- The analysis is based solely on the provided source code; the code was not executed, and its behavior in a live environment is not verified.
- 20 files in the repository were not included as text in the evidence packet and were not reviewed; their content is unknown.
- Binary content, if any, was not analyzed per the evidence envelope's binary policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-49098
Repository PoCStars: 0Created 2026-07-20ExploitCVE-2026-4909820 files
Analysis
Technical assessment
The artifact contains two self-contained Java projects (Spring Boot and Quarkus) that demonstrate exploitation of CVE-2026-49098. Each project includes an HTTP endpoint that, when triggered, sends an HTTP request with a 'kafka.OVERRIDE_TOPIC' header to a vulnerable Camel route, causing a Kafka message to be redirected to an attacker-chosen topic.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and two Java source files implementing a proof-of-concept for CVE-2026-49098. The code demonstrates the described vulnerability by sending HTTP requests with a kafka.OVERRIDE_TOPIC header to a local feedback endpoint and verifying that the message is redirected to an unintended Kafka topic. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads are present. The artifact's behavior is fully aligned with the stated purpose of demonstrating the publicly disclosed vulnerability.
Classification basis and observed behavior
Classification basis
The code actively exercises the vulnerability by sending a crafted HTTP request with a malicious header to a vulnerable endpoint and verifying the resulting unauthorized behavior (message redirection to an arbitrary topic). This constitutes an exploit.
camel-spring-boot/src/main/java/com/example/ExploitController.java:48-53camel-quarkus/src/main/java/com/example/ExploitResource.java:49-53Requirements
- A running instance of the vulnerable Camel application (provided in the artifact) with an HTTP consumer bridged to a Kafka producer.
README.md:19-25
Observed behavior
- Sends an HTTP POST request to a /feedback endpoint with a 'kafka.OVERRIDE_TOPIC' header set to a privileged topic name.
camel-spring-boot/src/main/java/com/example/ExploitController.java:71-77 - Checks the mock Kafka producer's history to verify that the produced record was published to the attacker-specified topic instead of the configured one.
camel-spring-boot/src/main/java/com/example/ExploitController.java:55-63
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThe PoC code demonstrates the CVE by sending an HTTP request with the header kafka.OVERRIDE_TOPIC to a local /feedback endpoint and checking the resulting Kafka topic. This is the normal exploit behavior for the stated target.
camel-spring-boot/src/main/java/com/example/ExploitController.java:74-75camel-quarkus/src/main/java/com/example/ExploitResource.java:73-74 - Local Testing
- Payload withheldThe PoC only communicates with a locally running application (localhost:8080). There is no exfiltration to external servers.
camel-spring-boot/src/main/java/com/example/ExploitController.java:72camel-quarkus/src/main/java/com/example/ExploitResource.java:71
What the analysis did not establish
- Only 3 of 20 files in the repository were provided as text evidence. The remaining 17 files, including build configurations and route definitions, were not analyzed.
- The evidence does not include the execution output, so the success of the exploit is based solely on the code's stated intent.
- 17 text files in the repository were not included in the evidence packet; their content was not reviewed.
- The evidence packet includes only three files (README.md, ExploitController.java, ExploitResource.java). Other project files such as build configurations, Dockerfiles, and route definitions were not provided.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-49097
Repository PoCStars: 0Created 2026-07-20ExploitCVE-2026-4909713 files
Analysis
Technical assessment
The artifact is a self-contained Java application that demonstrates exploitation of CVE-2026-49097. It sets up a victim Camel route bridging an HTTP endpoint to an IRC producer, then uses an attacker controller to send an HTTP request with the 'irc.sendTo' header, which redirects the IRC message to an attacker-chosen channel, proving exfiltration.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a PoC for CVE-2026-49097, a publicly disclosed header injection vulnerability in Apache Camel's IRC component. The reviewed files (Dockerfile, README.md, pom.xml, ExploitController.java) describe and implement a self-contained demonstration of the vulnerability. The ExploitController acts as an attacker driver that sends HTTP requests to a local victim route, injecting the 'irc.sendTo' header to redirect an IRC message. All behavior is consistent with demonstrating the described vulnerability; no concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor indicators are present.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exercises the vulnerability by sending a crafted HTTP request with the malicious 'irc.sendTo' header to redirect an IRC message to an attacker-controlled destination, demonstrating the impact of information disclosure. This is an exploit, not merely a scanner or writeup.
src/main/java/com/example/ExploitController.java:47-50src/main/java/com/example/ExploitController.java:72README.md:30Requirements
- A Camel route bridges an HTTP consumer (e.g., platform-http) into an irc: producer.
README.md:24-25 - The HTTP consumer is unauthenticated.
README.md:42 - The attacker can send HTTP requests to the consumer endpoint.
src/main/java/com/example/ExploitController.java:69-70
Observed behavior
- The application starts a victim route that listens on /notify and forwards messages to an IRC channel #alerts.
README.md:64-65 - The ExploitController sends a legitimate POST to /notify without the irc.sendTo header; the message is delivered to #alerts.
src/main/java/com/example/ExploitController.java:41-44 - The ExploitController sends a second POST to /notify with the header 'irc.sendTo: #exfil-channel'; the message is delivered to #exfil-channel instead of #alerts.
src/main/java/com/example/ExploitController.java:47-50 - The application outputs a success message confirming the header injection and message redirection.
src/main/java/com/example/ExploitController.java:55-57
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core PoC logic demonstrating the CVE-2026-49097 header injection vulnerability.
src/main/java/com/example/ExploitController.java:33-85 - Dependency
- Payload withheldThe PoC uses a known vulnerable version of the Apache Camel IRC component to demonstrate the issue.
pom.xml:36-40
What the analysis did not establish
- Only 4 of 13 text files were included in the evidence; 9 files were omitted, including potentially critical source files like VictimRoute.java, RecordingIRCConnection.java, and Application.java.
- The evidence does not include the full source code of the application, limiting verification of the complete exploit chain.
- The artifact uses a simulated IRC connection (RecordingIRCConnection) instead of a real IRC server, which may not fully represent a real-world attack scenario.
- 9 files in the repository were not included in the text evidence; their content is unknown. These include Java source files for the victim route, recording IRC connection, and other components.
- Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-49086
Repository PoCStars: 0Created 2026-07-20ExploitCVE-2026-4908612 files
Analysis
Technical assessment
The artifact is a self-contained Java/Spring Boot application that demonstrates exploitation of CVE-2026-49086. It sets up a vulnerable Apache Camel route, mocks the Dapr SDK to avoid needing a real sidecar, and includes an attacker controller (ExploitController) that delivers forged CloudEvents to trigger the routing-header override, redirecting a republished message to an attacker-chosen destination.
Backdoor review
No backdoor observed in reviewed code
The repository is a proof-of-concept (PoC) for CVE-2026-49086, a publicly disclosed vulnerability in Apache Camel's camel-dapr component. All reviewed code (Dockerfile, README.md, pom.xml, ExploitController.java) demonstrates the vulnerability by setting up a victim route and an attacker driver that delivers forged CloudEvents to trigger the routing-header override. The code performs only the described exploit behavior: it captures the subscription listener, delivers crafted events, and records the resulting publish target to prove the confused-deputy issue. No backdoor, concealed executable behavior, persistence, credential theft, or unrelated payload is present. The artifact is self-contained and does not exfiltrate data externally; it only logs and returns the observed routing behavior.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exercises the vulnerability by delivering a malicious CloudEvent to trigger the routing-header override, causing the application to republish a message to an attacker-controlled destination. This goes beyond detection or scanning; it performs the exploitation steps to demonstrate impact.
src/main/java/com/example/ExploitController.java:36-73src/main/java/com/example/ExploitController.java:76-96README.md:3-4Requirements
- A route consumes from a dapr:pubSub topic and republishes via a dapr:pubSub producer; attacker can publish to the subscribed topic.
README.md:41
Observed behavior
- Sets up a victim Camel route that consumes from 'orders-broker/orders' and republishes to 'audit-broker/audit-log'.
README.md:64-66 - ExploitController delivers a CloudEvent with forged pubsubName='attacker-broker' and topic='exfil-secrets' to the captured subscription listener.
src/main/java/com/example/ExploitController.java:57-58src/main/java/com/example/ExploitController.java:80-81 - The republished message is recorded as being sent to 'attacker-broker/exfil-secrets' instead of the configured 'audit-broker/audit-log', demonstrating redirection.
src/main/java/com/example/ExploitController.java:59-61src/main/java/com/example/ExploitController.java:63-68
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core of the PoC and matches the described CVE-2026-49086 behavior. It is not a backdoor.
src/main/java/com/example/ExploitController.java:35-97 - Mock Dapr Clients
- Payload withheldThis is a legitimate testing technique to isolate the vulnerable Camel component. It does not introduce hidden behavior.
README.md:52-59 - Affected Version
- Payload withheldThe PoC intentionally uses a vulnerable version to demonstrate the issue, as stated in the README and pom.xml.
pom.xml:20README.md:42
What the analysis did not establish
- Only 4 of 12 text files are included; the remaining 8 files (including VictimRoutes.java, DaprMockConfig.java, PublishRecorder.java, SubscriptionRegistry.java, Application.java, application.properties, docker-compose.yml) are omitted, so the full implementation of mock clients and route setup is not directly visible.
- The evidence is limited to static source code analysis; no runtime execution or output verification was performed.
- 8 files in the repository were not provided as text content and were not analyzed. These include Java source files (Application.java, DaprMockConfig.java, PublishRecorder.java, SubscriptionRegistry.java, VictimRoutes.java) and a properties file, which are part of the PoC infrastructure. Their omission limits completeness, but the provided ExploitController.java contains the attacker driver and the README describes the full layout, making a backdoor unlikely in the unseen files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-49042
Repository PoCStars: 0Created 2026-07-20ExploitCVE-2026-4904222 files
Analysis
Technical assessment
The artifact contains two self-contained proof-of-concept exploit projects (Spring Boot and Quarkus) for CVE-2026-49042. They demonstrate remote code execution and SSRF by sending a prompt-injected message to a mock LLM agent, which causes the vulnerable LangChain4jToolsProducer to copy attacker-controlled tool-call arguments into Camel Exchange headers, hijacking downstream producers.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files constitute a proof-of-concept exploit for CVE-2026-49042. The code demonstrates the vulnerability by sending a crafted request to a local server and checking for expected side effects (file creation, SSRF). No concealed executable behavior, persistence, credential exfiltration to an external party, or unrelated payload was observed. The artifact's behavior is consistent with its stated purpose of demonstrating a publicly disclosed vulnerability.
Classification basis and observed behavior
Classification basis
The artifact is classified as an exploit because it contains complete, runnable code that actively exercises the vulnerability to achieve remote code execution and SSRF, not merely detecting or reporting it. The README explicitly describes them as 'Runnable proof-of-concept reproducers' and the code performs the attack and verifies its impact.
README.md:3camel-spring-boot/src/main/java/com/example/ExploitController.java:66-72camel-quarkus/src/main/java/com/example/ExploitResource.java:72-77Requirements
- A running instance of the vulnerable Apache Camel application with the langchain4j-tools component and a downstream producer (e.g., exec, http) configured.
README.md:7-8 - Ability to send an HTTP POST request to the application's /chat endpoint.
camel-quarkus/src/main/java/com/example/ExploitResource.java:44-46
Observed behavior
- Sends a crafted user message containing a prompt injection to the /chat endpoint.
camel-quarkus/src/main/java/com/example/ExploitResource.java:37-41camel-spring-boot/src/main/java/com/example/ExploitController.java:33-38 - The mock model includes attacker-specified fields (e.g., CamelHttpUri, CamelExecCommandExecutable) in the tool-call arguments.
camel-quarkus/src/main/java/com/example/ExploitResource.java:39-40camel-spring-boot/src/main/java/com/example/ExploitController.java:35-37 - The vulnerable component copies these fields into Camel Exchange headers, hijacking the downstream producer to execute an arbitrary command (RCE) or make an HTTP request to an internal endpoint (SSRF).
README.md:11-14 - The exploit verifies success by checking for a created file (payload withheld) or a hit on an internal endpoint and disclosure of a secret.
camel-spring-boot/src/main/java/com/example/ExploitController.java:56-63camel-quarkus/src/main/java/com/example/ExploitResource.java:59-64
Behaviors behind the backdoor verdict
Observables
- File Creation
- Payload withheldThe Spring Boot PoC checks for the creation of this file as proof of successful command injection.
camel-spring-boot/src/main/java/com/example/ExploitController.java:25camel-spring-boot/src/main/java/com/example/ExploitController.java:37camel-spring-boot/src/main/java/com/example/ExploitController.java:58-59 - Http Request
- Payload withheldThe Quarkus PoC injects this URL to demonstrate SSRF and secret disclosure via the Camel HTTP producer.
camel-quarkus/src/main/java/com/example/ExploitResource.java:40 - Command Execution
- Payload withheldThe Spring Boot PoC injects this command to demonstrate remote code execution via the Camel exec producer.
camel-spring-boot/src/main/java/com/example/ExploitController.java:36-37
What the analysis did not establish
- Only 3 of 22 files in the repository are included in the evidence; the remaining 19 files (e.g., pom.xml, Dockerfiles, route definitions) are omitted, so the full exploit setup and configuration cannot be verified.
- The evidence packet reports 'complete_artifact_coverage: false' and 'selected_text_files_without_content: 19', indicating a partial view of the artifact.
- 19 of 22 files in the repository were not provided as text content and were not analyzed. The metadata classifies them as unclassified or non-text, but their contents are unknown.
- The review is limited to static analysis of the provided source code excerpts; no dynamic analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-48206
Repository PoCStars: 0Created 2026-07-20ExploitCVE-2026-4820619 files
Analysis
Technical assessment
The artifact contains two self-contained, runnable proof-of-concept applications (Spring Boot and Quarkus) that demonstrate exploitation of CVE-2026-48206. Each includes an attacker endpoint that sends an HTTP request with an injected 'IssueKey' header to a victim Camel route, causing the route's JIRA producer to delete an arbitrary issue using the service account's credentials.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and two Java source files that implement a proof-of-concept for CVE-2026-48206. The code demonstrates the described vulnerability by sending an HTTP request with an 'IssueKey' header to a local endpoint. No concealed executable behavior, persistence, credential theft, or unrelated payload is present. The artifact's behavior is limited to illustrating the header injection flaw.
Classification basis and observed behavior
Classification basis
The code is designed to actively exercise the vulnerability by sending a crafted HTTP request that triggers the unauthorized JIRA operation. It is not merely checking for the presence of the vulnerability; it performs the malicious action (deleting an arbitrary issue) and verifies the result. The README explicitly describes it as a 'Runnable proof-of-concept reproducer' and provides commands to build and execute the attack.
README.md:3README.md:20-26camel-spring-boot/src/main/java/com/example/ExploitController.java:13-17Requirements
- A running instance of the vulnerable Camel application with a route that bridges an HTTP consumer to a camel-jira producer.
README.md:10-15 - The attacker must be able to send HTTP requests to the victim's endpoint.
camel-spring-boot/src/main/java/com/example/ExploitController.java:21
Observed behavior
- The attacker endpoint sends a legitimate request without the IssueKey header, then sends the same request with an injected 'IssueKey: PROD-999' header.
camel-spring-boot/src/main/java/com/example/ExploitController.java:33-42 - The injected header bypasses the HTTP header filter and overrides the JIRA operation parameter, causing the service account to delete the issue 'PROD-999' instead of the intended draft.
camel-spring-boot/src/main/java/com/example/ExploitController.java:38-42camel-spring-boot/src/main/java/com/example/ExploitController.java:55-56 - The exploit code checks the result and reports whether the authorization bypass was successful.
camel-spring-boot/src/main/java/com/example/ExploitController.java:39-45
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the normal exploit behavior for CVE-2026-48206 and does not constitute a backdoor.
camel-quarkus/src/main/java/com/example/ExploitResource.java:55-59camel-spring-boot/src/main/java/com/example/ExploitController.java:52-57
What the analysis did not establish
- Only 3 of 19 files in the repository were provided as text evidence. The remaining 16 files, which likely include the victim route definitions, mock JIRA implementations, and build configurations, were not included.
- The evidence does not include the output of executing the exploit, so the reported behavior is based solely on the source code's stated intent.
- 16 files in the repository were not included in the text evidence; their content is unknown.
- Binary files, if any, were not analyzed per the evidence envelope policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-48205
Repository PoCStars: 1Created 2026-07-17ExploitCVE-2026-4820510 files
Analysis
Technical assessment
The artifact is a self-contained exploit for CVE-2026-48205. It includes a vulnerable Apache Camel route, a fake attacker-controlled DNS server, and an attacker controller that injects the 'dns.server' header to redirect DNS queries, demonstrating SSRF.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a proof-of-concept (PoC) for CVE-2026-48205, a publicly disclosed SSRF vulnerability in Apache Camel's DNS component. The PoC demonstrates how an unauthenticated HTTP client can inject a 'dns.server' header to redirect DNS queries to an attacker-controlled server. All provided source code (ExploitController.java, Dockerfile, pom.xml, README.md) is consistent with this stated purpose. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed. The artifact operates entirely within its described scope of demonstrating the header-injection vulnerability.
Classification basis and observed behavior
Classification basis
The artifact contains executable code (ExploitController.java) that actively injects a malicious header to trigger the vulnerability and redirect a DNS query to an attacker-controlled server (FakeDnsServer), which is the definition of an exploit.
src/main/java/com/example/ExploitController.java:27-28src/main/java/com/example/ExploitController.java:64-66README.md:81Requirements
- A vulnerable version of Apache Camel (4.0.0 to <4.14.8, 4.15.0 to <4.18.3, 4.19.0 to <4.21.0) with a route bridging an HTTP consumer to a dns: producer.
README.md:27-29 - The attacker must be able to send HTTP requests to the vulnerable Camel route.
README.md:11-12
Observed behavior
- The ExploitController sends an HTTP request to the victim route with a 'dns.server' header set to '127.0.0.1'.
src/main/java/com/example/ExploitController.java:64-66 - The injected header bypasses the HTTP filter and is used by the DnsDigProducer to create a SimpleResolver, redirecting the DNS query to the attacker's server.
README.md:44-45 - The attacker's FakeDnsServer receives the DNS query, proving the SSRF and allowing observation of the queried hostname.
README.md:109-110
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core behavior of the PoC, matching the described CVE-2026-48205 vulnerability.
src/main/java/com/example/ExploitController.java:61-73 - Network Communication
- Payload withheldAll network communication is local to the container and serves the PoC demonstration.
src/main/java/com/example/ExploitController.java:20Dockerfile:5-7 - Dependency Manifest
- Payload withheldThis confirms the PoC targets the vulnerable component version.
pom.xml:20pom.xml:29-39
What the analysis did not establish
- material evidence limitation
- Six files from the repository were not included as text in the evidence packet: Application.java, FakeDnsServer.java, VictimRoute.java, application.properties, docker-compose.yml, and a test file. Their content was not reviewed.
- The evidence packet contains no binary analysis; any compiled JAR or class files were not inspected.
- The review is limited to static analysis of the provided source code; no dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-48204
Repository PoCStars: 0Created 2026-07-17Not analyzedCVE-2026-4820421 files
GitHuboscerd/CVE-2026-48203
Repository PoCStars: 0Created 2026-07-17ExploitCVE-2026-4820323 files
Analysis
Technical assessment
The artifact contains two self-contained, runnable proof-of-concept exploit implementations (Camel Spring Boot and Camel Quarkus) for CVE-2026-48203. The code acts as an unauthenticated HTTP client that sends crafted SolrField.* and SolrParam.* headers to a vulnerable Apache Camel route, demonstrating document field injection and server-side request forgery (SSRF) via the shards parameter.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and two Java source files implementing a proof-of-concept for CVE-2026-48203. The code demonstrates the documented vulnerability by sending HTTP requests with SolrField.* and SolrParam.* headers to a local Camel application and verifying the resulting document field injection and SSRF. No concealed executable behavior, persistence, credential theft, unrelated payload, or operator-directed harm is present. The artifact's behavior is limited to the described exploit demonstration.
Classification basis and observed behavior
Classification basis
The code actively exercises the vulnerability by sending malicious headers to a target application and verifying the resulting injection and SSRF. It is described as a 'Runnable proof-of-concept reproducer' and includes steps to build, deploy, and trigger the attack.
README.md:3README.md:23-29camel-quarkus/src/main/java/com/example/ExploitResource.java:13-17Requirements
- A running Apache Camel instance with a route that bridges an HTTP consumer to a camel-solr producer using an affected version.
README.md:10-15 - A Solr instance accessible to the Camel application.
README.md:20
Observed behavior
- Sends an HTTP POST request to a victim /index endpoint with a 'SolrField.injected_role_s' header set to 'admin-INJECTED'.
camel-quarkus/src/main/java/com/example/ExploitResource.java:45camel-quarkus/src/main/java/com/example/ExploitResource.java:78-84 - Verifies the injected field and value are present in the indexed Solr document by querying Solr directly.
camel-quarkus/src/main/java/com/example/ExploitResource.java:46-51 - Sends an HTTP POST request to a victim /search endpoint with a 'SolrParam.shards' header pointing to an internal listener, triggering an SSRF.
camel-quarkus/src/main/java/com/example/ExploitResource.java:54-57 - Checks an internal listener to confirm the Solr server made a server-side request to the attacker-specified URL.
camel-quarkus/src/main/java/com/example/ExploitResource.java:58-66
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal exploit behavior for the stated vulnerability and does not constitute a backdoor.
camel-quarkus/src/main/java/com/example/ExploitResource.java:78-96camel-spring-boot/src/main/java/com/example/ExploitController.java:75-93 - Network Target
- Payload withheldThe PoC targets a local Camel application, consistent with a self-contained vulnerability demonstration.
camel-quarkus/src/main/java/com/example/ExploitResource.java:22-23camel-spring-boot/src/main/java/com/example/ExploitController.java:21-22
What the analysis did not establish
- material evidence limitation
- 20 text files in the repository were not included in the evidence packet; their content is unknown.
- Binary files were flagged as metadata-only and not analyzed; no binary content was reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-47323
Repository PoCStars: 0Created 2026-07-17ExploitCVE-2026-4732310 files
Analysis
Technical assessment
The artifact is a self-contained Java application that demonstrates exploitation of CVE-2026-47323. It sets up a vulnerable Apache Camel CXF-RS endpoint and includes an attacker controller that sends HTTP requests with injected CamelExecCommandExecutable and CamelExecCommandArgs headers to achieve remote code execution by creating a file (/tmp/pwned).
Backdoor review
No backdoor observed in reviewed code
The repository is a proof-of-concept (PoC) for CVE-2026-47323, a publicly disclosed header-injection vulnerability in Apache Camel. All reviewed source code (README.md, Dockerfile, pom.xml, ExploitController.java) describes and implements a legitimate demonstration of the vulnerability: an unauthenticated attacker injects CamelExec* headers to achieve remote code execution via a camel-exec sink. The ExploitController.java code performs exactly the attack described in the README, using a local HTTP call to the victim endpoint with injected headers. No concealed backdoor, unrelated payload, persistence mechanism, or deceptive behavior is present. The artifact's behavior is fully aligned with its stated purpose as a security research reproducer.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exploits the vulnerability by sending crafted HTTP requests with malicious headers to a vulnerable endpoint, resulting in the execution of an attacker-controlled command. This goes beyond mere detection or scanning.
src/main/java/com/example/ExploitController.java:14-17src/main/java/com/example/ExploitController.java:44src/main/java/com/example/ExploitController.java:68-70Requirements
- Java 17+ and Maven 3.8+
README.md:87-88 - Docker (optional, for containerised run)
README.md:88
Observed behavior
- Builds and runs a Spring Boot application with a vulnerable Apache Camel route (cxfrs consumer -> exec producer).
README.md:57-59pom.xml:31-41 - Exposes an attacker endpoint (/exploit/attack) that sends a GET request to the victim CXF-RS endpoint with injected CamelExecCommandExecutable and CamelExecCommandArgs headers.
src/main/java/com/example/ExploitController.java:30-31src/main/java/com/example/ExploitController.java:63-71 - The injected headers override the configured 'echo' command, causing the camel-exec producer to execute '/usr/bin/touch /tmp/pwned'.
src/main/java/com/example/ExploitController.java:44src/main/java/com/example/ExploitController.java:68-70 - Checks for the existence of the file '/tmp/pwned' to confirm successful remote code execution.
src/main/java/com/example/ExploitController.java:45-51src/main/java/com/example/ExploitController.java:55
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core PoC behavior, demonstrating the CVE-2026-47323 header injection. It is not a backdoor; it is the advertised exploit.
src/main/java/com/example/ExploitController.java:44src/main/java/com/example/ExploitController.java:68-70 - Command Execution
- Payload withheldThis is the specific command used in the PoC to create a marker file, confirming RCE. It is a harmless touch command, not a malicious payload.
src/main/java/com/example/ExploitController.java:44 - Self Contained Attack
- Payload withheldThe PoC is self-contained; it does not exfiltrate data or connect to external attacker-controlled infrastructure.
src/main/java/com/example/ExploitController.java:23
What the analysis did not establish
- material evidence limitation
- 6 out of 10 files in the repository were not provided as text and were not reviewed. These include Application.java, VictimRoute.java, ApiResource.java, application.properties, docker-compose.yml, and a test file. Their content could theoretically contain unrelated malicious code, but the provided evidence shows no indication of this.
- The compiled JAR file (target/cve-2026-47323-cxfrs-0.0.1-SNAPSHOT.jar) referenced in the Dockerfile was not provided and was not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46726
Repository PoCStars: 0Created 2026-07-16ExploitCVE-2026-4672619 files
Analysis
Technical assessment
The artifact contains runnable proof-of-concept exploit code for CVE-2026-46726, an SSRF and secret disclosure vulnerability in Apache Camel's Vertx WebSocket component. It provides two self-contained projects (Spring Boot and Quarkus) that demonstrate how an unauthenticated attacker can inject a 'CamelHttpUri' query parameter into a WebSocket connection to redirect a downstream HTTP producer to an attacker-controlled destination, and leak secrets via Camel property placeholder resolution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a proof-of-concept (PoC) repository for CVE-2026-46726, demonstrating a known SSRF and secret disclosure vulnerability in Apache Camel's Vertx WebSocket component. The reviewed Java source files (ExploitResource.java, ExploitController.java) and README.md describe and implement a client that triggers the vulnerability by injecting a CamelHttpUri query parameter into a WebSocket connection. The code performs only the documented exploit behavior: connecting to a local WebSocket endpoint, sending a crafted query parameter to redirect a downstream HTTP request, and verifying the resulting SSRF and secret disclosure. No concealed backdoor, persistence mechanism, credential theft, or unrelated payload is present. The artifact is a standard, self-contained vulnerability reproducer for a publicly disclosed and fixed CVE.
Classification basis and observed behavior
Classification basis
The artifact is classified as an exploit because it contains complete, runnable code that exercises the vulnerability to achieve SSRF and secret disclosure. The README explicitly describes it as a 'Runnable proof-of-concept reproducer' and provides instructions to build and run the attack. The Java code directly implements the attack by connecting to a WebSocket, injecting the malicious header, and verifying the resulting SSRF and data leak.
README.md:3README.md:24-30camel-quarkus/src/main/java/com/example/ExploitResource.java:1-84camel-spring-boot/src/main/java/com/example/ExploitController.java:1-79Requirements
- A vulnerable Apache Camel instance with a route that bridges a camel-vertx-websocket consumer to an HTTP producer.
README.md:10-15 - The WebSocket endpoint must be exposed without authentication.
README.md:10-15
Observed behavior
- The exploit code acts as an unauthenticated WebSocket client. It connects to the victim's WebSocket endpoint and injects a 'CamelHttpUri' query parameter.
camel-quarkus/src/main/java/com/example/ExploitResource.java:70-74camel-spring-boot/src/main/java/com/example/ExploitController.java:65-69 - The injected 'CamelHttpUri' header causes the server-side HTTP producer to make a request to an attacker-specified internal endpoint (SSRF).
camel-quarkus/src/main/java/com/example/ExploitResource.java:44-50camel-spring-boot/src/main/java/com/example/ExploitController.java:39-45 - The exploit injects a URI containing a Camel property placeholder (e.g., '{{app.secret}}'). The HTTP producer resolves this placeholder and sends the real secret value to an attacker-controlled collector.
camel-quarkus/src/main/java/com/example/ExploitResource.java:52-61camel-spring-boot/src/main/java/com/example/ExploitController.java:47-56
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThe code demonstrates the exact SSRF and secret disclosure described in the CVE advisory by injecting CamelHttpUri as a WebSocket query parameter.
camel-quarkus/src/main/java/com/example/ExploitResource.java:44-56camel-spring-boot/src/main/java/com/example/ExploitController.java:39-56 - Network Connection
- Payload withheldThe PoC connects to local WebSocket endpoints to trigger the vulnerability; all connections are local and expected for a self-contained reproducer.
camel-quarkus/src/main/java/com/example/ExploitResource.java:25camel-spring-boot/src/main/java/com/example/ExploitController.java:22
What the analysis did not establish
- The evidence packet reports 'complete_artifact_coverage: false' and 16 files were omitted from the text content. The analysis is based on the 3 provided text files (README.md and two exploit classes). The omitted files likely include project configuration (e.g., pom.xml, Dockerfile) and supporting classes (e.g., SinkController), which are not necessary for classifying the primary artifact's purpose.
- 16 files in the repository were not included in the text evidence; their content is unknown. The analysis covers only the three provided text files (README.md, ExploitResource.java, ExploitController.java).
- Binary files, if any, were not inspected per the evidence envelope's binary policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46592
Repository PoCStars: 0Created 2026-07-16ExploitCVE-2026-4659222 files
Analysis
Technical assessment
The artifact contains two self-contained projects (Spring Boot and Quarkus) that demonstrate exploitation of CVE-2026-46592. Each project includes an attacker component (ExploitController/ExploitResource) that sends an HTTP request with a malicious 'operationName' header to a vulnerable Camel route, causing the backend SOAP service to invoke a destructive 'deleteAccount' operation instead of the intended 'getBalance' operation.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence consists of a README and two Java exploit classes that demonstrate the publicly disclosed CVE-2026-46592 vulnerability. The code sends an HTTP request with an 'operationName' header to a local API endpoint to trigger a confused-deputy SOAP operation redirection. No concealed executable behavior, persistence, credential theft, unrelated remote access, or operator-directed harm is present. The artifact is a straightforward proof-of-concept for a known, fixed vulnerability.
Classification basis and observed behavior
Classification basis
The code is designed to exercise the vulnerability by sending a crafted request that triggers the unintended SOAP operation, and it verifies the destructive side effect. This is consistent with exploit code.
README.md:3camel-spring-boot/src/main/java/com/example/ExploitController.java:42-53Requirements
- A vulnerable Apache Camel route bridging an HTTP consumer to a cxf: producer with a default operation set.
README.md:10-15 - The attacker must be able to send HTTP requests to the vulnerable consumer endpoint.
camel-spring-boot/src/main/java/com/example/ExploitController.java:25
Observed behavior
- Sends an HTTP POST request to the victim's /api endpoint with a body and an 'operationName' header set to 'deleteAccount'.
camel-spring-boot/src/main/java/com/example/ExploitController.java:61-63 - The 'operationName' header bypasses the HTTP boundary filter because it is not in the 'Camel*' namespace.
camel-spring-boot/src/main/java/com/example/ExploitController.java:62 - The Camel CXF producer uses the injected header to resolve and invoke the 'deleteAccount' SOAP operation instead of the route's default 'getBalance'.
README.md:10-15 - The exploit verifies the attack by checking that the 'deleteAccount' operation was invoked and the account was deleted from the backend state.
camel-spring-boot/src/main/java/com/example/ExploitController.java:44-53
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldTarget API endpoint used by the exploit classes to demonstrate the vulnerability.
camel-quarkus/src/main/java/com/example/ExploitResource.java:27camel-spring-boot/src/main/java/com/example/ExploitController.java:25 - Http Header
- Payload withheldThe injected header that triggers the vulnerability by redirecting the SOAP operation.
camel-quarkus/src/main/java/com/example/ExploitResource.java:66camel-spring-boot/src/main/java/com/example/ExploitController.java:62
What the analysis did not establish
- Only 3 of 22 files were provided as text. The remaining 19 files (e.g., Dockerfiles, POMs, route definitions) were omitted, so the full exploit chain cannot be verified.
- 19 files in the repository were not included in the text evidence; their content is unknown.
- Binary files, if any, were flagged as metadata-only and not analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46591
Repository PoCStars: 0Created 2026-07-15ExploitCVE-2026-4659112 files
Analysis
Technical assessment
The artifact is a fully functional exploit for CVE-2026-46591, a Cypher injection vulnerability in Apache Camel's camel-neo4j component. It includes a vulnerable application (VictimRoute.java), a seeder to populate a Neo4j database, and an attacker controller (ExploitController.java) that sends a crafted HTTP request with a malicious JSON key to inject a UNION clause into a Cypher query, exfiltrating data from a 'Secret' node.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a PoC for CVE-2026-46591, a Cypher injection vulnerability in Apache Camel's camel-neo4j component. All supplied files (README.md, Dockerfile, pom.xml, ExploitController.java) describe and implement a legitimate demonstration of the disclosed vulnerability. The ExploitController acts as an HTTP client that sends crafted JSON to the victim route to trigger the injection and verify data exfiltration. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor activity is present. The artifact's behavior is entirely consistent with its stated purpose as a security research reproducer.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exploits the vulnerability. The ExploitController.java file constructs and sends a malicious payload to a vulnerable endpoint to exfiltrate data, which is the definition of an exploit.
src/main/java/com/example/ExploitController.java:31-32src/main/java/com/example/ExploitController.java:46-47Requirements
- A vulnerable Apache Camel route that maps untrusted input into the CamelNeo4jMatchProperties map for a RETRIEVE_NODES or DELETE_NODE operation.
README.md:24 - The attacker must be able to send HTTP requests to the vulnerable endpoint.
README.md:83-84
Observed behavior
- The ExploitController sends a legitimate HTTP POST request with a JSON body {"name":"alice"} to the /lookup endpoint, which returns only the matching Person node.
src/main/java/com/example/ExploitController.java:39-43 - The ExploitController sends a malicious HTTP POST request with a JSON body where the key contains a Cypher injection payload. This causes the server to execute a modified Cypher query that returns data from a Secret node in addition to the Person node.
src/main/java/com/example/ExploitController.java:46-52 - The exploit checks the response for a secret flag to confirm successful data exfiltration.
src/main/java/com/example/ExploitController.java:48
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core PoC logic, matching the disclosed vulnerability description.
src/main/java/com/example/ExploitController.java:31-32src/main/java/com/example/ExploitController.java:46-48 - Target Identification
- Payload withheldThe target is a locally hosted application, consistent with a self-contained reproducer environment.
src/main/java/com/example/ExploitController.java:26
What the analysis did not establish
- The evidence packet does not include the source code for the vulnerable VictimRoute.java, Application.java, or other supporting files, which are mentioned in the README.md but not provided. The analysis is based on the provided ExploitController.java and documentation.
- The evidence packet includes 8 unclassified files that were not analyzed, which may contain additional context.
- 8 text files (including VictimRoute.java, Neo4jSeeder.java, Application.java, Neo4jConfig.java, Neo4jSettings.java, application.properties, and docker-compose.yml) were present in the repository but not included in the evidence packet. Their content was not reviewed.
- The evidence packet contains no binary files, but the analysis scope notes 6094 unclassified bytes across 8 unclassified files; these were not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46590
Repository PoCStars: 0Created 2026-07-15ExploitCVE-2026-40048CVE-2026-4659017 files
Analysis
Technical assessment
The artifact contains two self-contained Java projects (Spring Boot and Quarkus) that demonstrate CVE-2026-46590. Each project includes an endpoint that, when triggered, plants a serialized CommonsCollections6 gadget chain as a legacy key file and then invokes the vulnerable FileBasedKeyLifecycleManager.getKey() method to trigger deserialization and achieve remote code execution, evidenced by creating a marker file.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a proof-of-concept (PoC) for CVE-2026-46590, a publicly disclosed deserialization vulnerability in Apache Camel PQC. The PoC demonstrates the vulnerability by planting a crafted serialized object and triggering its deserialization through the vulnerable library's normal API. The code's behavior is entirely consistent with demonstrating the described CVE; it does not contain any concealed, deceptive, or operator-directed harmful actions beyond the intended exploit demonstration.
Classification basis and observed behavior
Classification basis
The artifact is classified as an exploit because it contains complete, runnable code that actively exercises the vulnerability to achieve remote code execution. The code plants a malicious serialized object and then triggers its deserialization by the vulnerable component, which is the definition of an exploit. The README explicitly describes it as a 'Runnable proof-of-concept reproducer' and provides instructions to build and run it, which results in the execution of a command.
README.md:3README.md:20-26camel-quarkus/src/main/java/com/example/ExploitResource.java:44-50camel-quarkus/src/main/java/com/example/ExploitResource.java:56-59Requirements
- The attacker must be able to write a file to the key directory used by the FileBasedKeyLifecycleManager.
camel-quarkus/src/main/java/com/example/ExploitResource.java:40-50 - The target application must use a vulnerable version of Apache Camel PQC (4.18.0 to 4.18.2, or 4.19.0 to 4.20.0) and have the CommonsCollections library on its classpath.
README.md:7-8README.md:36
Observed behavior
- The code creates a temporary directory to simulate the key directory and writes a serialized Java object containing a CommonsCollections6 gadget chain to a file named '<keyId>.key'.
camel-quarkus/src/main/java/com/example/ExploitResource.java:40-50 - The code then instantiates FileBasedKeyLifecycleManager with the temporary directory and calls getKey(), which triggers the deserialization of the planted file via a raw ObjectInputStream without any filter.
camel-quarkus/src/main/java/com/example/ExploitResource.java:56-59 - The deserialized gadget chain executes the command '/usr/bin/touch /tmp/pwned', and the code checks for the existence of this marker file to confirm successful code execution.
camel-quarkus/src/main/java/com/example/ExploitResource.java:47camel-quarkus/src/main/java/com/example/ExploitResource.java:66-74
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the expected behavior for a PoC demonstrating CVE-2026-46590, which involves unsafe deserialization of legacy key files.
camel-quarkus/src/main/java/com/example/ExploitResource.java:44-60camel-spring-boot/src/main/java/com/example/ExploitController.java:41-61 - Payload Execution
- Payload withheldThis is a standard, non-malicious method for verifying that the deserialization vulnerability leads to arbitrary code execution, as described in the CVE.
camel-quarkus/src/main/java/com/example/ExploitResource.java:29camel-quarkus/src/main/java/com/example/ExploitResource.java:47camel-spring-boot/src/main/java/com/example/ExploitController.java:28camel-spring-boot/src/main/java/com/example/ExploitController.java:44 - Disclaimer
- Payload withheldThis indicates the author's stated intent is legitimate security research, not malicious deception.
README.md:43-46
What the analysis did not establish
- The evidence packet does not include the source code for the 'Gadget' class, which is responsible for generating the CommonsCollections6 gadget chain. This class is referenced but its implementation is not provided in the selected text files.
- The evidence packet reports 14 unclassified files and 3 selected text files. The content of the unclassified files, which may include the Gadget class or other project dependencies, is not available for analysis.
- The review is based solely on the three text files provided in the evidence packet. The artifact contains 14 other files (e.g., pom.xml, Dockerfile, Gadget.java) that were not included in the text content and were not analyzed. The behavior of the PoC depends on the contents of these unprovided files, particularly the Gadget class, which constructs the deserialization payload.
- The evidence packet metadata indicates 14 files were omitted from the text content. The analysis cannot confirm the behavior of the Gadget.commonsCollections6() method or other project dependencies without reviewing these files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46588
Repository PoCStars: 0Created 2026-07-15ExploitCVE-2026-4658811 files
Analysis
Technical assessment
The artifact is a fully functional exploit for CVE-2026-46588, an improper input validation vulnerability in Apache Camel's camel-couchdb component. It demonstrates operation confusion by injecting 'CouchDbMethod' and 'CouchDbId' headers into an HTTP request to a write-only ingestion endpoint, causing the server to read and then delete an arbitrary document.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a PoC for CVE-2026-46588, demonstrating a header injection vulnerability in Apache Camel's camel-couchdb component. The code shows a legitimate exploit scenario where an attacker uses crafted HTTP headers to perform unauthorized read and delete operations on a CouchDB database. No backdoor, trojan, or deceptive payload targeting the person running the PoC was observed. The artifact's behavior is consistent with its stated purpose of demonstrating the vulnerability.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exercises the vulnerability to achieve unauthorized read and delete operations, which is the definition of an exploit. The ExploitController.java file implements a multi-step attack that injects headers to cause operation confusion, leading to information disclosure and data destruction.
src/main/java/com/example/ExploitController.java:1-91README.md:12-17Requirements
- A vulnerable Apache Camel route with a couchdb producer behind an HTTP consumer (e.g., platform-http) must be running.
README.md:29-30 - The attacker must be able to send HTTP requests to the vulnerable endpoint.
README.md:9-10
Observed behavior
- Sends a legitimate POST request to the /ingest endpoint to save a document.
src/main/java/com/example/ExploitController.java:45-47 - Sends a POST request to the same /ingest endpoint with injected 'CouchDbMethod: GET' and 'CouchDbId: admin-secret' headers, causing the server to return the content of the 'admin-secret' document instead of saving the request body.
src/main/java/com/example/ExploitController.java:50-54 - Extracts the '_rev' field from the disclosed document.
src/main/java/com/example/ExploitController.java:57 - Sends a POST request with injected 'CouchDbMethod: DELETE' header and a body containing the document's '_id' and the leaked '_rev', causing the server to delete the 'admin-secret' document.
src/main/java/com/example/ExploitController.java:58-59
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the intended behavior of the PoC, not a backdoor. It shows the vulnerability described in the CVE.
src/main/java/com/example/ExploitController.java:49-59README.md:12-17 - Network Communication
- Payload withheldThis is part of the vulnerability demonstration, targeting the local victim application. It does not exfiltrate data to an external attacker-controlled server.
src/main/java/com/example/ExploitController.java:31src/main/java/com/example/ExploitController.java:73-84
What the analysis did not establish
- The evidence packet does not include the source code for VictimRoute.java, CouchDbHarness.java, CouchDbSettings.java, or Application.java, which are part of the complete artifact. The analysis is based on the provided ExploitController.java, README.md, pom.xml, and Dockerfile.
- The evidence packet reports 'complete_artifact_coverage: false' and 7 unclassified files, indicating that not all files from the repository snapshot were provided for analysis.
- Only 4 of 11 text files were included in the evidence packet. The omitted files (Application.java, CouchDbSettings.java, CouchDbHarness.java, VictimRoute.java, application.properties, docker-compose.yml, and one other) were not reviewed. Their content could contain additional behavior not visible in the provided evidence.
- The evidence packet includes metadata for 7 unclassified files totaling 7594 bytes, which were not analyzed. These files could potentially contain hidden content.
- The review is based solely on static analysis of the provided text; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46587
Repository PoCStars: 0Created 2026-07-15ExploitCVE-2026-4658711 files
Analysis
Technical assessment
The artifact is a fully functional exploit for CVE-2026-46587, a header injection vulnerability in Apache Camel's camel-couchbase component. It includes a vulnerable Camel route, a Couchbase harness, and an attacker controller that sends HTTP requests with injected CCB_ID and CCB_TTL headers to achieve unauthorized document disclosure, tampering, and data destruction.
Backdoor review
No backdoor observed in reviewed code
The reviewed evidence is a proof-of-concept (PoC) for CVE-2026-46587, demonstrating a header injection vulnerability in Apache Camel's camel-couchbase component. The code shows an HTTP client sending crafted CCB_ID and CCB_TTL headers to a victim route to achieve disclosure, tampering, and data destruction. All behavior is consistent with the stated vulnerability demonstration and contains no concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads.
Classification basis and observed behavior
Classification basis
The artifact contains code that actively exploits the vulnerability by sending crafted HTTP requests with malicious headers to a vulnerable application, resulting in unauthorized read, write, and data destruction operations. This goes beyond mere detection or scanning.
src/main/java/com/example/ExploitController.java:45-49src/main/java/com/example/ExploitController.java:57-63src/main/java/com/example/ExploitController.java:66-75Requirements
- A vulnerable Apache Camel route exposing a Couchbase producer behind an HTTP consumer (e.g., platform-http).
README.md:9-11 - The attacker must be able to send HTTP requests to the vulnerable endpoint.
README.md:9-11
Observed behavior
- Sends an HTTP GET request to /fetch with a CCB_ID header set to 'system-config' to read a protected document, demonstrating information disclosure.
src/main/java/com/example/ExploitController.java:45-49 - Sends an HTTP POST request to /save with a CCB_ID header set to 'system-config' and a malicious body to overwrite a protected document, demonstrating data tampering.
src/main/java/com/example/ExploitController.java:57-63 - Sends an HTTP POST request to /save with a CCB_TTL header set to '1' to force a document to expire almost immediately, demonstrating data destruction.
src/main/java/com/example/ExploitController.java:66-75
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core of the PoC, demonstrating the CVE-2026-46587 header injection flaw. It is expected behavior for a vulnerability reproducer.
src/main/java/com/example/ExploitController.java:84-105 - Network Communication
- Payload withheldThe attacker controller communicates only with the local victim application. No external or unrelated network endpoints are contacted.
src/main/java/com/example/ExploitController.java:26-27 - Documentation
- Payload withheldThe documentation is consistent with a legitimate security research PoC and contains no instructions for malicious actions beyond demonstrating the vulnerability.
README.md:1-165
What the analysis did not establish
- The evidence packet does not include the complete source code for all files (e.g., VictimRoute.java, CouchbaseHarness.java, Application.java, docker-compose.yml). The analysis is based on the provided README.md, ExploitController.java, pom.xml, and Dockerfile.
- The artifact's behavior is inferred from the source code and documentation; the code was not executed.
- Seven text files were omitted from the evidence packet (e.g., Application.java, VictimRoute.java, CouchbaseHarness.java, CouchbaseSettings.java, application.properties, docker-compose.yml). These files are part of the PoC infrastructure but were not provided for review. Their absence limits full verification of the complete artifact, though the supplied ExploitController.java contains the attacker logic and shows no backdoor behavior.
- No binary files were identified for analysis; the artifact is a Java source repository.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46585
Repository PoCStars: 0Created 2026-07-15ExploitCVE-2026-4658511 files
Analysis
Technical assessment
The artifact is a self-contained Java application that demonstrates CVE-2026-46585, a header injection vulnerability in Apache Camel's camel-lucene component. It sets up a victim route and an attacker endpoint that sends HTTP requests with a malicious 'QUERY' header to bypass authorization and exfiltrate data from a Lucene index.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a legitimate proof-of-concept (PoC) for CVE-2026-46585, a publicly disclosed vulnerability in Apache Camel's camel-lucene component. The PoC demonstrates a header injection/authorization bypass by sending crafted HTTP requests to a local victim service. All code and documentation serve only to illustrate the vulnerability and its impact; no concealed, deceptive, or operator-directed harmful behavior is present.
Classification basis and observed behavior
Classification basis
The artifact includes code that actively exercises the vulnerability by sending malicious requests to a vulnerable endpoint to achieve unauthorized data access, which is the definition of an exploit.
src/main/java/com/example/ExploitController.java:58-65README.md:12-14Requirements
- A route exposes a lucene:...:query producer behind an HTTP consumer (e.g. platform-http).
README.md:26 - The attacker must be able to send HTTP requests to the vulnerable endpoint.
README.md:8-9
Observed behavior
- The application starts a web server with a victim route at '/search' that queries a Lucene index using the value of the 'QUERY' header.
README.md:64-66 - The '/exploit/attack' endpoint acts as an attacker, sending HTTP requests to the victim route with a crafted 'QUERY' header to read a secret document and dump the entire index.
src/main/java/com/example/ExploitController.java:27-54 - The exploit demonstrates that an unauthenticated client can bypass authorization by injecting a Lucene query (e.g., 'visibility:secret' or '*:*') via the 'QUERY' header, which is not filtered by the framework.
README.md:12-14src/main/java/com/example/ExploitController.java:40-44
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the core of the PoC, showing how an attacker can exploit the CVE. It targets a locally running service and does not exfiltrate data to an external party.
src/main/java/com/example/ExploitController.java:27-65 - Vulnerability Description
- Payload withheldThis is standard documentation for a security PoC, providing context for the demonstrated behavior.
README.md:1-181
What the analysis did not establish
- The evidence packet does not include the source code for all application components (e.g., VictimRoute.java, IndexBootstrap.java), limiting full verification of the victim setup.
- The analysis is based solely on the provided text files; the artifact was not executed.
- Seven files in the repository were omitted from the text evidence and were not analyzed. Their content is unknown, but the provided inventory indicates they are part of the standard Java project structure (e.g., Application.java, VictimRoute.java) and are unlikely to contain backdoor behavior given the context of the reviewed files.
- The analysis is based solely on the supplied text content; no dynamic or binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46584
Repository PoCStars: 0Created 2026-07-14ExploitCVE-2026-4658421 files
Analysis
Technical assessment
The artifact contains two self-contained, runnable proof-of-concept applications (Spring Boot and Quarkus) that demonstrate exploitation of CVE-2026-46584. The code acts as an attacker, sending HTTP requests with injected `mail.smtp.socks.host` and `mail.smtp.socks.port` headers to a vulnerable Camel route. This causes the victim's authenticated SMTP connection to be tunneled through an attacker-controlled SOCKS proxy, which harvests the plaintext credentials.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a proof-of-concept (PoC) for CVE-2026-46584, a publicly disclosed vulnerability in Apache Camel. The PoC demonstrates the vulnerability by sending HTTP requests with specific headers to a local victim endpoint, which then routes SMTP traffic through a local attacker-controlled SOCKS proxy to demonstrate credential interception. All code operates locally, targets the explicitly described vulnerability, and contains no concealed, deceptive, or unrelated harmful behavior. The README clearly states the purpose is for security research on a fixed vulnerability.
Classification basis and observed behavior
Classification basis
The code is designed to actively exploit the vulnerability by sending malicious HTTP requests to a vulnerable endpoint and intercepting the resulting SMTP credentials. It is not merely detecting the vulnerability but exercising it to achieve a specific impact (credential theft).
README.md:3camel-quarkus/src/main/java/com/example/ExploitResource.java:50-64camel-spring-boot/src/main/java/com/example/ExploitController.java:47-61Requirements
- A vulnerable version of Apache Camel Mail component (4.0.0 to 4.14.7, 4.15.0 to 4.18.2, or 4.19.0 to 4.20.0) must be running with a route that passes untrusted HTTP input to an SMTP producer without stripping the `mail.smtp.*` header namespace.
README.md:10-16 - The attacker must be able to send HTTP requests to the victim's endpoint.
README.md:26
Observed behavior
- The attacker sends an HTTP POST request to the victim's `/send` endpoint with injected `mail.smtp.socks.host` and `mail.smtp.socks.port` headers.
camel-quarkus/src/main/java/com/example/ExploitResource.java:74-82camel-spring-boot/src/main/java/com/example/ExploitController.java:71-79 - The victim's Camel Mail producer applies the injected headers as JavaMail session properties, overriding the endpoint configuration.
README.md:10-12 - The victim's authenticated SMTP connection is tunneled through the attacker's SOCKS proxy, which intercepts and steals the plaintext AUTH LOGIN credentials.
camel-quarkus/src/main/java/com/example/ExploitResource.java:14-20camel-spring-boot/src/main/java/com/example/ExploitController.java:13-19 - The exploit code verifies the theft by checking that the stolen username and password match the victim's configured credentials ('victim' / 's3cr3t-smtp-pw').
camel-quarkus/src/main/java/com/example/ExploitResource.java:66-70camel-spring-boot/src/main/java/com/example/ExploitController.java:63-67
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the expected behavior for a PoC demonstrating CVE-2026-46584. The code only interacts with localhost services and does not exfiltrate data externally.
camel-quarkus/src/main/java/com/example/ExploitResource.java:78-81camel-spring-boot/src/main/java/com/example/ExploitController.java:75-78 - Local Network Activity
- Payload withheldAll network communication is confined to localhost, consistent with a self-contained PoC. No external connections are made.
camel-quarkus/src/main/java/com/example/ExploitResource.java:29camel-spring-boot/src/main/java/com/example/ExploitController.java:28 - Disclaimer
- Payload withheldThis indicates the author's stated intent and aligns with the observed behavior of the code.
README.md:43-46
What the analysis did not establish
- The evidence packet does not include the full source code for the project. The provided files are the README and the attacker-side exploit controllers. The victim-side Camel route configuration, the in-JVM SMTP server, and the SOCKS proxy implementation are not included in the selected text, limiting full verification of the exploit chain.
- 18 files in the repository were not provided as text content and were not analyzed. Their metadata is present but their contents are unknown.
- Binary files, if any, were flagged as metadata-only and not analyzed.
- The review is limited to the supplied evidence and does not assess the safety of executing the PoC in a non-isolated environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHuboscerd/CVE-2026-46457
Repository PoCStars: 0Created 2026-07-14ExploitCVE-2026-4645719 files
Analysis
Technical assessment
The artifact contains two self-contained, runnable proof-of-concept applications (Spring Boot and Quarkus) that demonstrate payload withheld. The code acts as a client publishing to a NATS subject, injecting a 'CamelHttpUri' header to redirect a downstream Apache Camel HTTP producer to an internal endpoint, achieving Server-Side Request Forgery (SSRF).
Backdoor review
No backdoor observed in reviewed code
The supplied text files are a documented proof-of-concept for payload withheld. The README explains the vulnerability and provides build/run instructions. The two Java classes implement a legitimate and an attack message to demonstrate header injection leading to SSRF. No concealed, deceptive, or operator-directed harmful behavior is present; the code performs exactly the described exploit demonstration.
Classification basis and observed behavior
Classification basis
The artifact is classified as an exploit because it contains complete, runnable code that actively exercises the vulnerability by injecting a malicious header to redirect a server-side request, as stated in its README and demonstrated in its source code.
README.md:3camel-quarkus/src/main/java/com/example/ExploitResource.java:16-23Requirements
- A NATS server must be running and accessible without authentication.
README.md:17 - The attacker must be able to publish messages to the NATS subject consumed by the vulnerable Camel route.
camel-quarkus/src/main/java/com/example/ExploitResource.java:16
Observed behavior
- The exploit publishes a legitimate message to a NATS subject, which is relayed to the intended backend.
camel-quarkus/src/main/java/com/example/ExploitResource.java:38-39 - The exploit publishes an attack message with a 'CamelHttpUri' NATS header, which causes the downstream Camel HTTP producer to send a request to an attacker-specified internal URL.
camel-quarkus/src/main/java/com/example/ExploitResource.java:43-46 - The code checks if the internal endpoint was reached, confirming the SSRF vulnerability.
camel-quarkus/src/main/java/com/example/ExploitResource.java:48
Behaviors behind the backdoor verdict
Observables
- Cve Reference
- Payload withheldThe artifact is explicitly a PoC for this publicly disclosed vulnerability.
README.md:1 - Exploit Behavior
- Payload withheldThis is the documented exploit demonstration; it is not concealed and matches the CVE description.
camel-quarkus/src/main/java/com/example/ExploitResource.java:44-46camel-spring-boot/src/main/java/com/example/ExploitController.java:42-44
What the analysis did not establish
- Only 3 of 19 files in the repository were provided as text evidence. The remaining 16 files, including build configurations and other source code, were not analyzed.
- The evidence packet reports 'complete_artifact_coverage: false'.
- Only 3 of 19 repository files were provided as text; 16 files (including build files, Dockerfiles, and other Java classes) were omitted. The review cannot assess those files for backdoor behavior.
- Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.