Skip to content

CVE-2025-60021: Verified Repro With Script Download

CVE-2025-60021: Apache bRPC: Remote Command Injection in Heap Profiler

Download script Open in Codespaces

CVE-2025-60021 is verified against brpc · cpp. Affected versions: 1.11.0 to <1.15.0. Fixed in 1.15.0. Vulnerability class: Command Injection. This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00072.

REPRO-2026-00072 brpc · cpp Command Injection Jan 21, 2026 CVE entry ↗ .txt
Severity
CRITICAL
CVSS
9.8
Reproduced in
47m 53s
Tool calls
503
01 · Overview

What Is CVE-2025-60021?

CVE-2025-60021 is a high-severity remote command injection vulnerability in Apache bRPC's built-in heap profiler endpoint (/pprof/heap), reachable when jemalloc profiling is enabled. Pruva reproduced it (reproduction REPRO-2026-00072).

02 · Severity & CVSS

CVE-2025-60021 Severity & CVSS Score

CVE-2025-60021 is rated critical severity, with a CVSS base score of 9.8 out of 10.

CRITICAL threat level
9.8 / 10 CVSS base
Weakness CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')

Critical — the most severe class — typically remotely exploitable with severe impact. Treat as an emergency.

03 · Affected Versions

Affected brpc Versions

brpc · cpp versions 1.11.0 to <1.15.0 are affected.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2025-60021

$ pruva-verify REPRO-2026-00072
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00072/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2025-60021

Reproduced by Pruva's autonomous agents — 503 tool calls over 48 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 741 events · 503 tool calls · 48 min
48 minDuration
503Tool calls
232Reasoning steps
741Events
Agent activity over 48 min
Support
1
Repro
560
Coding
174
0:0047:53

Root Cause and Exploit Chain for CVE-2025-60021

Summary

Apache bRPC versions 1.11.0 through 1.14.x allow remote command injection via the built-in /pprof/heap endpoint when jemalloc profiling is enabled. The handler concatenates the user-controlled extra_options query parameter directly into a shell command used to invoke jeprof, and the command is executed through popen, allowing shell metacharacters to execute arbitrary commands.

Impact

  • Component: src/brpc/details/jemalloc_profiler.cpp (jemalloc heap profiler endpoint /pprof/heap)
  • Affected versions: 1.11.0 to <1.15.0
  • Risk level: Important — remote command execution as the service user, enabling data exfiltration and lateral movement.

Root Cause

The heap profiler handler builds a command line for jeprof and appends the extra_options query parameter without validation:

  • Vulnerable code (1.14.1): cmd_str += " --" + *uri_extra_options + " ";
  • The command is executed via butil::read_command_output, which uses popen() (/bin/sh -c), so shell metacharacters in extra_options are interpreted.

The fix in 1.15.0 introduces a whitelist of allowed extra_options values and ignores unsupported inputs, preventing shell metacharacter injection. See PR https://github.com/apache/brpc/pull/3101.

Reproduction Steps

  1. Run repro/reproduction_steps.sh.
  2. The script builds bRPC 1.14.1 and 1.15.0, starts the echo server with jemalloc profiling enabled, then issues crafted /pprof/heap requests.
  3. Expected evidence: uid=... appears in logs/vuln_response.txt for 1.14.1 and is absent in logs/fixed_response.txt for 1.15.0.

Evidence

  • Vulnerable response (1.14.1): logs/vuln_response.txt
    • uid=0(root) gid=0(root) groups=0(root) (line 82)
  • Fixed response (1.15.0): logs/fixed_response.txt
    • No uid= output present.
  • Build and runtime logs:
    • logs/echo_server_vuln.log
    • logs/echo_server_fixed.log

Environment details:

  • Ubuntu with system dependencies installed via apt-get.
  • jemalloc enabled via MALLOC_CONF=prof:true and LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libjemalloc.so.2.

Recommendations / Next Steps

  • Upgrade to bRPC 1.15.0 or apply the whitelist patch from PR #3101.
  • Consider avoiding shell execution entirely (pass arguments directly to execve without shell) for any future tooling.
  • Add regression tests for /pprof/heap to ensure only approved options are accepted.

Additional Notes

  • Idempotency verified: repro/reproduction_steps.sh executed twice successfully.
  • The exploit only applies when jemalloc profiling is enabled and /pprof/heap is reachable.

CVE-2025-60021 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:001:09
0:00
session startedgpt-5-codex · cve-2025-60021 · f7799ab1
0:14
extract_facts
output{"stored": true, "fact_count": 2}
0:15
supportrepro
0:15
supportrepro
0:17
0:17
0:17
0:19
0:19
0:21
0:21
0:24
0:24
0:26
0:26
0:29
0:29
$ls -la /workspace
✓
ls: cannot access '/workspace': No such file or directory
0:29
$
✓
{"output":"{\"returncode\": 2, \"stdout\": \"\", \"stderr\": \"ls: cannot access '/workspace': No such file or directory\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/cve-2025-60021\"}"}
0:31
0:31
$pwd
✓
/home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/cve-2025-60021
0:31
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"/home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/cve-2025-60021\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/cve-"}
0:33
0:33
$ls -la /home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404
✓
total 19
drwxr-xr-x 4 root root 4096 Jan 20 23:34 .
drwxr-xr-x 4 root root 4096 Jan 20 23:34 ..
drwxr-xr-x 6 root root 4096 Jan 20 23:34 cve-2025-60021
drwxr-xr-x 2 root root 4096 Jan 20 23:34 repo
-rw-r--r-- 1 root root  503 Jan 20 23:34 trace.json
-rw-r--r-- 1 root root 2029 Jan 20 23:34 trace_spans.jsonl
0:33
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 19\\ndrwxr-xr-x 4 root root 4096 Jan 20 23:34 .\\ndrwxr-xr-x 4 root root 4096 Jan 20 23:34 ..\\ndrwxr-xr-x 6 root root 4096 Jan 20 23:34 cve-2025-60021\\ndrwxr-xr-x 2 ro"}
0:35
0:35
$ls -la /home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/repo
✓
total 8
drwxr-xr-x 2 root root 4096 Jan 20 23:34 .
drwxr-xr-x 4 root root 4096 Jan 20 23:34 ..
0:35
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 20 23:34 .\\ndrwxr-xr-x 4 root root 4096 Jan 20 23:34 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/cve-2025-60021/2"}
0:38
0:38
$ls -la /home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/cve-2025-60021/artifacts/prepped
✓
total 8
drwxr-xr-x 2 root root 4096 Jan 20 23:34 .
drwxr-xr-x 3 root root 4096 Jan 20 23:34 ..
0:38
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 20 23:34 .\\ndrwxr-xr-x 3 root root 4096 Jan 20 23:34 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/cve-2025-60021/2"}
0:41
0:41
$git --version
✓
git version 2.43.0
0:41
$python3 --version
✓
Python 3.11.14
0:42
$curl --version
✓
curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/8.5.0 OpenSSL/3.0.13 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libidn2/2.3.7 libpsl/0.21.2 (+libidn2/2.3.7) libssh/0.10.6/openssl/zlib nghttp2/1.59.0 librtmp/2.3 OpenLDAP/2.6.7
Release-Date: 2023-12-06, security patched: 8.5.0-2ubuntu10.6
Protocols: dict file ftp ftps gopher gophers http https imap imaps ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd
0:42
0:42
0:45
1:04
$git clone https://github.com/apache/brpc.git /home/user/pruva/work/brpc
19.3s✓
Cloning into '/home/user/pruva/work/brpc'...
1:04
$
19.3s✓
{"output":"{\"returncode\": 0, \"stdout\": \"\", \"stderr\": \"Cloning into '/home/user/pruva/work/brpc'...\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/cve-2025-60021/20260120-233404/cve-2025-60021\"}"}
1:09

Artifacts and Evidence for CVE-2025-60021

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2025-60021

Upgrade brpc · cpp to 1.15.0 or later.

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2025-60021 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2025-60021

How does the CVE-2025-60021 command injection attack work?

The constructed command string is executed through butil::read_command_output, which uses popen() (i.e. /bin/sh -c), so shell metacharacters embedded in the extra_options query parameter are interpreted by the shell. A remote attacker can run arbitrary commands as the service user simply by requesting /pprof/heap with a crafted extra_options value.

Which bRPC versions are affected by CVE-2025-60021, and where is it fixed?

Apache bRPC 1.11.0 to <1.15.0 is affected. It is fixed in 1.15.0, which introduces a whitelist of allowed extra_options values and ignores unsupported inputs.

How severe is CVE-2025-60021?

It is rated high ("Important") severity: remote command execution as the service user, enabling data exfiltration and lateral movement.

How can I reproduce CVE-2025-60021?

Download the verified script from this page and run it in an isolated environment against Apache bRPC 1.14.1 with jemalloc profiling enabled on an echo server. It issues a crafted /pprof/heap request with a malicious extra_options parameter and shows the injected command's output appearing in the response, then confirms 1.15.0 rejects the same payload.
11 · References

References for CVE-2025-60021

Authoritative sources for CVE-2025-60021 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.