Apache Camel is an open-source integration framework used to route and process messages. It provides a variety of components to facilitate different integrations, including the camel-exec component, which allows for command execution. All known Camel HTTP components, such as camel-servlet, camel-jetty, camel-undertow, camel-platform-http, and camel-netty-http, are vulnerable by default. Recently, security vulnerabilities were discovered in multiple versions of Apache Camel, which could expose applications to Remote Code Execution (RCE) attacks. Organizations using vulnerable versions must act immediately to mitigate these risks.

Product	Jetty – Apache Camel
Date	2025-03-18 11:29:24
Information	Trending Fix Available

Technical Summary

Two critical vulnerabilities have been identified in the Apache Camel Exec component:

CVE-2025-27636: Filter bypass via case-insensitive headers

Apache Camel filters certain headers to prevent unauthorized command execution. However, due to improper handling of case sensitivity, an attacker can bypass these restrictions by sending headers with different combinations of uppercase and lowercase letters (e.g., CAmelExecCommandExecutable). This allows them to override predefined static commands and execute arbitrary system commands.

Exploitation example:

An attacker can override the static command execution using a specially crafted request:

curl "http://target-site.com/vulnerable" --header "CAmelExecCommandExecutable: ls"

The server will execute ls instead of the intended command.

CVE-2025-29891: Query parameter injection

A separate but related vulnerability allows attackers to inject execution commands via query parameters, bypassing intended filtering mechanisms. By specifying the CAmelExecCommandExecutable parameter, an attacker can inject arbitrary commands into the execution flow.

Exploitation example:

curl "http://target-site.com/vulnerable?CAmelExecCommandExecutable=ls"

This leads to arbitrary command execution on the backend, exposing the system to severe security risks.

Recommendations

To mitigate these vulnerabilities, affected users should:

1. Update Apache Camel: Ensure the installation is updated to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS, or 3.22.4 for 3.x releases.
2. Implement WAF (Web Application Firewall) rules: Block suspicious headers and query parameters related to CamelExecCommandExecutable.
3. Restrict execution permissions: Allow the ability to execute commands only where strictly necessary.
4. Monitor logs and alerts: Regularly inspect logs to detect unusual command execution patterns and set up alerts for potential exploitation attempts.