Reverse Shell using File Upload Vulnerability and Command Injection Demo(PinewoodStore Docker Lab)

🚨 **Critical Security Demo: Apache Camel 4.10.0 Command Injection + PinewoodStore Upload Flaw** 🚨

In this video, we demonstrate a **real-world vulnerability chain** combining an insecure file upload flaw in the PinewoodStore application with a **command injection vulnerability in Apache Camel 4.10.0**, leading to **remote code execution** and a **reverse shell**.

---

🎉 **ANNOUNCEMENT:**
The **PinewoodStore Vulnerable Application** is being **released TODAY** for **security enthusiasts, red teamers, and penetration testers** to practice and explore real-world exploitation scenarios.
🔥 Download, deploy, and learn how insecure coding patterns can lead to full system compromise — all in a safe, controlled environment.

---

### 🔍 Code Overview:

The showcased Java Spring controller snippet handles image uploads at `/upload/productimage` but contains critical security flaws:

* **Only checks file extensions** like `.jpg`, `.png` — does **not inspect the actual file content**.
* **Saves files directly to disk** with no path normalization or sanitization.

Combined with Apache Camel’s vulnerable input evaluation in version **4.10.0**, this creates a perfect opportunity for **command injection and reverse shell execution**.

---

### ⚠️ CVE Context:

* **Apache Camel 4.10.0** suffers from a **command injection vulnerability** that enables arbitrary code execution under certain unsafe configurations.
* When files from insecure upload endpoints are processed by Camel, exploitation is trivial.

---

### 🔥 Key Security Risks Demonstrated:

* No **content-based validation** (MIME-type or magic byte checking missing)
* No **filename/path sanitization**
* Dangerous **trust in user-controlled input**
* Ideal for chained exploitation with middleware like Apache Camel

---

### 🧪 What You'll Learn:

* How attackers bypass extension checks using disguised payloads
* How file uploads can pivot into backend RCE
* How to properly secure file upload features in Java/Spring apps

🔐 **Security Best Practices Covered:**

* Enforcing real content inspection (MIME type, file headers)
* Safe storage practices (renaming, sandboxing uploads)
* Hardening Apache Camel against unsafe expressions and route configs

---

🛑 **DISCLAIMER:** This demo is for **educational purposes only**. All testing should be performed in isolated environments that you own or have permission to use.

📥 **Download PinewoodStore**: \[Link to release or repo]

\#PinewoodStore #JavaSecurity #ApacheCamel #ReverseShell #CommandInjection #CVE2024 #FileUploadExploit #SpringBoot #CyberSecurity #PenTesting #BugBounty