Apache Camel's Jetty/Servlet usage is vulnerable to Java object
de-serialisation vulnerability
If using camel-jetty, or camel-servlet as a consumer in Camel routes,
then Camel will automatic de-serialize HTTP requests that uses the
content-header: application/x-java-serialized-object.
Please
Was curious how easy this was to exploit, so I decided to play around a little.
We deploy entirely into OSGi environments either in apache servicemix or apache
karaf, so that's where my testing was focused.
There is a github project which handily creates sample payloads given a command
of your
