Apache bRPC Heap Profiler - Remote Command Injection
Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service (/pprof/heap). The extra_options query parameter is concatenated directly into a shell command string passed to popen() without any validation or sanitization, allowing unauthenticated attackers to execute arbitrary OS commands on the server. The display parameter must be set to text, svg, or flamegraph to reach the vulnerable code path, and jemalloc profiling must be active (MALLOC_CONF=prof:true). References: https://nvd.nist.gov/vuln/detail/CVE-2025-60021 https://github.com/apache/brpc/pull/3101 https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m Remediation: Upgrade Apache bRPC to version 1.15.0 or later, which introduces a whitelist of valid profiler options (inuse_space, inuse_objects, alloc_space, alloc_objects, show_bytes, drop_negative, total_delay, contentions, mean_delay). Alternatively, restrict network access to built-in service endpoints.
10 assets checked · domain, subdomain, ipv4