CVE-2025-60021: Apache bRPC Vulnerability Allows Remote Command Injection

Jan 17
1 min read

Key Findings

Apache has patched a vulnerability (CVE-2025-60021) in its bRPC C++ RPC framework
The flaw allows remote command injection by manipulating the `extra_options` parameter in the `/pprof/heap` endpoint
The vulnerability affects bRPC versions 1.11.0 through 1.14.0, and is rated as "Important"
bRPC is widely used in high-performance systems for search, storage, ML, advertising, and recommendation
Successful exploitation could allow attackers to execute remote commands on affected servers

Background

bRPC is an industrial-grade C++ RPC framework developed by Apache to power some of the world's most demanding systems. It is widely used in sectors such as search, storage, machine learning, advertising, and recommendation. The framework's performance and reliability make it a critical component of many high-load applications.

Vulnerability Details

The vulnerability (CVE-2025-60021) lies within the heap profiler built-in service, a diagnostic tool designed to help developers analyze memory usage. Specifically, the flaw affects the `/pprof/heap` endpoint, where the `extra_options` parameter is not properly validated. Attackers can manipulate this parameter to execute remote commands on the server, effectively bypassing security controls.

Impact

The widespread use of bRPC in sensitive, high-performance environments makes this vulnerability a potentially lucrative target for threat actors. Successful exploitation could allow attackers to gain a foothold in critical infrastructure, posing a significant operational risk.

Remediation

Apache has provided two paths to remediation:

Upgrade: Update the framework to version 1.15.0 or later
Patch: Apply the manual patch available via the project's GitHub repository (Pull Request #3101)

System administrators and developers using bRPC are strongly advised to patch their environments immediately to close this remote code execution (RCE) vector.

Sources

https://securityonline.info/cve-2025-60021-apache-brpc-flaw-opens-door-to-remote-command-injection/
https://x.com/the_yellow_fall/status/2012359144938819857