# CVE-2025-60021: Apache bRPC Remote Command Injection Vulnerability

## Summary

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC (all versions < 1.15.0) on all platforms allows attacker to inject remote commands.

## Vulnerability Details

- **CVE ID**: CVE-2025-60021
- **Severity**: Important
- **Affected Package**: Apache bRPC
- **Affected Versions**: 1.11.0 before 1.15.0
- **Fixed Version**: 1.15.0
- **Ecosystem**: C++ / Bazel

## Root Cause

The bRPC heap profiler built-in service (`/pprof/heap`) does not validate the user-provided `extra_options` parameter and executes it as a command-line argument. Attackers can execute remote commands using the `extra_options` parameter.

## Affected Scenarios

Use the built-in bRPC heap profiler service to perform jemalloc memory profiling.

## Vulnerable Endpoint

The vulnerability exists in the `/pprof/heap` endpoint which accepts an `extra_options` parameter that is passed directly to command execution without sanitization.

## Technical Details

When a user makes a request to the heap profiler endpoint with a crafted `extra_options` parameter, the value is passed unsanitized to a shell command. This allows command injection via shell metacharacters.

Example attack vector:
```
GET /pprof/heap?extra_options=;id; HTTP/1.1
```

or

```
GET /pprof/heap?extra_options=$(whoami) HTTP/1.1
```

## Remediation

Two methods available:
1. Upgrade bRPC to version 1.15.0
2. Apply the patch from https://github.com/apache/brpc/pull/3101 manually

## References

- Apache bRPC: https://brpc.apache.org
- CVE Record: https://www.cve.org/CVERecord?id=CVE-2025-60021
- Mailing List: https://lists.apache.org/thread/xy51d2fx6drzhfp92xptsx5845q7b37m
- Fix PR: https://github.com/apache/brpc/pull/3101

## Credit

- Reporter: Simcha Kosman
- Disclosed by: Guangming Chen (Friday, 16 January 2026)