CVE-2025-60021: 
Homebrew vulnerability analysis and mitigation

CVE-2025-60021 is a remote command injection vulnerability in the heap profiler built-in service of Apache bRPC, affecting all versions from 1.11.0 up to (but not including) 1.15.0 on all platforms. The flaw was reported by Simcha Kosman and disclosed publicly on January 16, 2026, via the Apache Security mailing list and oss-security. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by CISA-ADP (Openwall OSS-Sec, Feedly).

The root cause (CWE-77: Improper Neutralization of Special Elements used in a Command) lies in the /pprof/heap built-in endpoint, which accepts a user-supplied extra_options parameter and passes it directly as a command-line argument without any sanitization or validation. This flaw is only exploitable when the bRPC heap profiler service is enabled and configured to use jemalloc memory profiling. An unauthenticated, network-adjacent attacker can craft an HTTP request to the /pprof/heap endpoint with a malicious extra_options value to inject and execute arbitrary OS commands on the server. A public PoC has been published on GitHub (GitHub PoC, Openwall OSS-Sec).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the affected server with the privileges of the bRPC process, potentially achieving complete system compromise. This includes unauthorized access to sensitive data (confidentiality impact: HIGH), modification or deletion of data and configurations (integrity impact: HIGH), and disruption of service availability (availability impact: HIGH). Given that bRPC is widely used in high-performance distributed systems and AI infrastructure, exploitation could facilitate lateral movement within internal networks and exposure of sensitive backend data (Feedly, SecurityOnline).

A public proof-of-concept exploit has been published on GitHub by user ninjazan420, and additional PoC repositories (e.g., Ashwesker/Ashwesker-CVE-2025-60021) have appeared (GitHub PoC). The vulnerability has been referenced in threat intelligence reports linking it to the Qilin ransomware affiliate (AgendaCrypt malware family), suggesting potential use in targeted attacks against organizations (Ctrl-Alt-Intel). The EPSS score is approximately 0.67%, indicating a relatively low but non-negligible probability of exploitation in the wild. As of the available data, CVE-2025-60021 has not been added to the CISA KEV catalog, and no confirmed mass exploitation has been documented (Feedly).

1. Reconnaissance: Identify internet-facing or internally accessible Apache bRPC services (versions 1.11.0–1.14.x) using network scanners (e.g., Shodan, Censys, nmap) targeting common bRPC ports. Confirm the heap profiler endpoint is accessible by sending a GET request to /pprof/heap.
2. Verify jemalloc profiling is active: Check if the service responds to /pprof/heap requests, which indicates the heap profiler built-in service is enabled and jemalloc is in use — a prerequisite for exploitation.
3. Craft malicious request: Construct an HTTP GET or POST request to /pprof/heap with a malicious extra_options parameter containing OS command injection payloads (e.g., extra_options=; id; whoami or using shell metacharacters to chain commands).
4. Inject and execute command: Submit the crafted request to the target. The bRPC service passes the unsanitized extra_options value directly to a command-line execution context, causing the injected command to run with the privileges of the bRPC process.
5. Establish persistence or exfiltrate data: Use the achieved command execution to deploy a reverse shell, download additional tools, exfiltrate sensitive data, or pivot to other internal systems (Openwall OSS-Sec, GitHub PoC).

• Network: Unexpected or anomalous HTTP requests to /pprof/heap endpoint, especially from external or untrusted IP addresses; outbound connections from the bRPC server process to unknown external hosts following such requests.
• Logs: Web/access logs showing requests to /pprof/heap with unusual or encoded extra_options parameter values containing shell metacharacters (;, |, &&, backticks, $()).
• Process: Unusual child processes spawned by the bRPC server process (e.g., /bin/sh, /bin/bash, curl, wget, python, nc) — particularly those not expected in normal bRPC operation.
• File System: Unexpected new files, scripts, or binaries written to the bRPC working directory or /tmp; new cron jobs or scheduled tasks created by the bRPC service account.
• Network Signatures: Emerging Threats ruleset update (2026-02-05, v11119) includes detection rules for this vulnerability (Emerging Threats).

The primary remediation is to upgrade Apache bRPC to version 1.15.0, which addresses the vulnerability by validating the extra_options parameter (Openwall OSS-Sec). For systems that cannot be immediately upgraded, the Apache project provides a manual patch available at GitHub PR #3101. As an interim workaround, restrict network access to the /pprof/heap endpoint using firewall rules or reverse proxy ACLs, limiting access to trusted administrative networks only. Disabling the heap profiler built-in service if jemalloc memory profiling is not required also eliminates the attack surface.

The vulnerability received notable coverage across security media outlets including SecurityOnline, CyberSecurityNews, The Hacker News (weekly recap), and SecurityBrief, highlighting its critical severity and potential impact on AI and distributed systems infrastructure (SecurityOnline, The Hacker News). A blog post titled "How Apache bRPC's Performance Tools Grant Unauthenticated Root Access" drew attention to the severity of exposing debug/profiling endpoints in production environments. The CVE appeared in multiple weekly trending CVE lists on Reddit's r/CVEWatch and was discussed on Bluesky and Mastodon by infosec community accounts. Check Point published a defense advisory (CPAI-2025-11229), and Emerging Threats added detection rules to their ruleset (Check Point, Emerging Threats).