PT-2026-120567 · Apache · Apache Brpc
CVE-2026-86147
·
تاريخ النشر
2026-10-21
·
تاريخ التحديث
2026-10-21
لا يوجد
لا تتوفر حاليًا تقييمات أو مقاييس للخطورة. سنحدّث المعلومات المقابلة في الصفحة فور توفرها.
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite files with the privileges of the server process, or to hold the process-wide CPU/contention profiler for an arbitrarily long time.
Root Cause:
- The builtin /flags service allows gflags carrying a validator to be modified at runtime via ?setvalue=. The bvar/mbvar dump path gflags (bvar dump file, bvar dump tabs, mbvar dump file) were registered with an accept-anything validator whose only purpose was to wake the dumping thread. A remote attacker could therefore repoint the dump path (e.g. GET /flags/bvar dump file?setvalue=/victim/dir/target followed by GET /flags/bvar dump?setvalue=true, or the equivalent for mbvar dump file, which is used verbatim without a forced suffix), making the dumping thread recursively create directories and open/truncate files at attacker-chosen locations. Tab names in bvar dump tabs were appended to the path without sanitization, allowing '..' to escape the configured directory.
- The /pprof builtin service did not clamp the ?seconds= parameter to FLAGS max profiling seconds (a limit that /hotspots enforced). A single request such as ?seconds=2147483647 made the handler sleep for decades while holding the process-wide gperftools CPU profiler or bthread contention profiler, so /hotspots/cpu and /hotspots/contention returned 503 for everyone else during that time.
Affected Scenarios:
Any Apache bRPC server exposing the builtin services (enabled by default on the same port as normal RPC traffic) to untrusted networks.
How to Fix:
(Choose one of the following options)
- Upgrade bRPC to version 1.18.0, which fixes this issue.
- Apply this patch: https://github.com/apache/brpc/pull/3523
Note:
After the fix, bvar dump file, bvar dump tabs and mbvar dump file can no longer be modified at runtime through the /flags builtin service. They can still be changed programmatically via google::SetCommandLineOption(), taking effect on the next dump cycle. The profiling duration of /pprof is now capped by the -max profiling seconds gflag (default 300 seconds), which can be adjusted by the server owner.
Resource Exhaustion
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
المعرّفات ذات الصلة
المنتجات المتأثرة
Apache Brpc