CVE-2024-22369

Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC and 1 curated repository PoC to CVE-2024-22369.

Description

Deserialization of Untrusted Data vulnerability in Apache Camel SQL ComponentThis issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22.0 before 3.22.1, from 4.0.0 before 4.0.4, from 4.1.0 before 4.4.0. Users are recommended to upgrade to version 4.4.0, which fixes the issue. If users are on the 4.0.x LTS releases stream, then they are suggested to upgrade to 4.0.4. If users are on 3.x, they are suggested to move to 3.21.4 or 3.22.1

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 20, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Apache Camel

Browse Apache Software Foundation / Apache Camelorg.apache.camel:camel-sql

Default status: unaffected

CVE List3.0.0 to < 3.21.4affected
3.22.0 to < 3.22.1affected
4.0.0 to < 4.0.4affected
4.1.0 to < 4.4.0affected

camel

Browse apache / camel

Default status: unknown

CVE List3.0.0 to < 3.21.4affected
3.22.0 to < 3.22.1affected
4.0.0 to < 4.0.4affected
4.1.0 to < 4.4.0affected

org.apache.camel:camel-sql

Browse Maven / org.apache.camel:camel-sql
GitHub Advisory3.0.0 to < 3.21.4 · Fixed in 3.21.4affected
3.22.0 to < 3.22.1 · Fixed in 3.22.1affected
4.0.0 to < 4.0.4 · Fixed in 4.0.4affected
4.1.0 to < 4.4.0 · Fixed in 4.4.0affected

Proofs of concept

2

Curated repository PoCs

GitHubCVE-2026-27172Curated repository PoCby SecureWithUmer34Exploit7 files

C++ · 14.5 KiB · linked to 4 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a fully functional exploit for CVE-2026-27172, a Java deserialization vulnerability in Apache Camel's ConsulRegistry. It provides a Spring Boot application with REST endpoints to inject a malicious serialized payload into a Consul KV store and trigger its deserialization, leading to remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a publicly disclosed deserialization vulnerability (CVE-2026-27172) in Apache Camel's ConsulRegistry. All provided source code (README, Application.java, ConsulRegistryRoute.java, ExploitController.java) is consistent with a legitimate proof-of-concept: it sets up a vulnerable registry, accepts a user-supplied Base64 payload, writes it to a Consul KV store, and triggers deserialization via lookupByName. No concealed backdoor, unrelated remote access, persistence, or deceptive payload targeting the person running the PoC was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesJava
Target softwareApache Camelcamel-consul
Attack typesDeserialization of Untrusted DataRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable code (ExploitController.java) that actively injects a malicious payload into a vulnerable component and triggers its deserialization to achieve remote code execution. The README explicitly describes this as a 'Reproducer' and provides commands to generate and deliver a payload, which is the definition of an exploit.

oscerd-CVE-2026-27172-07ec7b0/README.md:1oscerd-CVE-2026-27172-07ec7b0/src/main/java/com/example/ExploitController.java:60-64oscerd-CVE-2026-27172-07ec7b0/src/main/java/com/example/ExploitController.java:78-82

Requirements

  • A running Consul agent with an accessible KV store.oscerd-CVE-2026-27172-07ec7b0/README.md:55
  • A vulnerable version of Apache Camel (3.0.0 to before 4.14.6, or 4.15.0 to before 4.18.1).oscerd-CVE-2026-27172-07ec7b0/README.md:19
  • A gadget library (e.g., commons-collections 3.x) on the application's classpath.oscerd-CVE-2026-27172-07ec7b0/README.md:130-131
  • The ysoserial tool to generate a malicious serialized payload.oscerd-CVE-2026-27172-07ec7b0/README.md:56

Observed behavior

  • The ExploitController provides an /exploit/inject endpoint that accepts a Base64-encoded serialized payload and writes it directly to the Consul KV store.oscerd-CVE-2026-27172-07ec7b0/src/main/java/com/example/ExploitController.java:60-64
  • The /exploit/trigger endpoint calls ConsulRegistry.lookupByName(), which reads the value from the Consul KV store, Base64-decodes it, and deserializes it using a raw ObjectInputStream without an ObjectInputFilter, executing the injected gadget chain.oscerd-CVE-2026-27172-07ec7b0/src/main/java/com/example/ExploitController.java:78-82
  • The README provides step-by-step instructions to generate a payload with ysoserial (e.g., 'touch /tmp/pwned') and verify successful exploitation by checking for the created file.oscerd-CVE-2026-27172-07ec7b0/README.md:85oscerd-CVE-2026-27172-07ec7b0/README.md:110-112
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
Payload withheldThis is the expected behavior for a PoC of CVE-2026-27172, which involves unsafe deserialization in ConsulRegistry.oscerd-CVE-2026-27172-07ec7b0/src/main/java/com/example/ExploitController.java:37-89
External Tool Usage
Payload withheldThe PoC relies on an external, well-known security research tool to create the gadget chain; the PoC itself does not bundle or execute any payload.oscerd-CVE-2026-27172-07ec7b0/README.md:79-86
Route Disabled
Payload withheldThe route that would automatically trigger deserialization is disabled, leaving control to the user via the ExploitController. This reduces risk of accidental exploitation.oscerd-CVE-2026-27172-07ec7b0/src/main/java/com/example/ConsulRegistryRoute.java:17-30
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the artifact unit were included. The analysis is based on the four provided text files.
  • The pom.xml file, which would confirm the exact vulnerable dependency version, is listed in the README but its content was not provided in the evidence.
  • Only the four text files included in the evidence packet were reviewed. The pom.xml and application.properties files were not provided, so their contents (e.g., dependency versions, additional configurations) could not be verified.
  • The evidence packet reports 3 unclassified files totaling 2269 bytes that were not analyzed; their content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHuboscerd/CVE-2024-22369Repository PoCby oscerd4Not analyzed9 files

47.9 KiB

GitHub
PoC details

References

Showing 12 of 14