Apache bRPC vulnerabilities

Remote command injection vulnerability in heap profiler builtin service in Apache bRPC (all versions < 1.15.0) on all platforms allows attacker to inject remote command. Root Cause: The bRPC heap profiler built-in service (/pprof/heap) does not validate the user-provided extra_options parameter and executes it as a command-line argument. Attackers can execute remote commands using the extra_options parameter. Affected scenarios: Use the built-in bRPC heap profiler service to perform jemalloc memory profiling. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.15.0. 2. Apply this patch ( https://github.com/apache/brpc/pull/3101 ) manually.

The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A packet with declared zero payload length passes the frame-length check, after which the parser reads the response type byte via an unbounded 5-byte fetch that returns nullptr, causing type = p[4] to dereference it and crash the client process.

A vulnerability in the Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that they are objects. A malformed Discovery response whose data/service members or instances list contain non-object entries triggers an out-of-bounds read and potentially crashes the bRPC client.

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. Verification runs only for the first message of a connection and the result latches the connection, so a request such as GET /status to internal_port authenticates the whole connection.

Apache bRPC versions before 1.18.0 expose builtin /flags and /pprof services that allow a remote attacker to change dump paths (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) and create directories or overwrite files with the server process privileges. Additionally, the ?seconds= parameter in /pprof is not clamped, enabling an attacker to hold the process-wide CPU profiler for an arbitrarily long time.

HTTP request/response smuggling vulnerability in Apache bRPC versions < 1.18.0 stems from inconsistent HTTP/1.1 header parsing in its bundled parser. bRPC accepts malformed header forms (space before colon, spaces in Content-Length values, obs-fold, chunked trailers merged as headers, Transfer-Encoding lists with whitespace), allowing attackers to smuggle requests or headers when bRPC is deployed behind a proxy or load balancer.

Improper authorization in Apache bRPC (versions < 1.18.0) allows remote attackers to access builtin services through the public port. Protobuf-based protocol dispatch paths computed but did not enforce the security_mode flag, allowing invocation of services such as brpc.vars or hotspots.

A vulnerability in Apache bRPC (versions < 1.18.0) stems from an interpretation conflict in HTTP path handling between bRPC and a front proxy. The FindMethodPropertyByURI() function skips empty path segments (consecutive slashes), so paths like //flags are dispatched as /flags, even though RFC 3986 treats them as distinct. Additionally, HTTP/2 does not validate the :path pseudo-header, allowing bypass of proxy ACL rules and access to internal services.

A use-after-free exists in the RTMP protocol implementation in Apache bRPC (version < 1.18.0). A malicious RTMP peer can crash the process or potentially corrupt memory via a crafted Abort message. The root cause is that the receive path deletes the target RtmpChunkStream object while the send path concurrently dereferences it without synchronization.

A NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (versions < 1.18.0) occurs when the server rejects a createStream request by returning a null stream and then fails to write the error response, causing a crash. A remote attacker can trigger a denial of service by sending a crafted createStream command and closing the connection before the rejection response is written.

A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. After the RDMA handshake completes, the server keeps parsing the TCP fd as an RPC channel, sharing the input buffer and parser state with RDMA CQ event processing without synchronization, leading to corruption and a crash.

A vulnerability in Apache bRPC versions before 1.18.0 allows a malicious remote peer to crash the process by racing connection teardown against health check revival. In the window where the Socket is addressable but has no file descriptor, a CHECK failure terminates the process, resulting in denial of service.

A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the server returns a T_EXCEPTION reply with a malformed exception struct, the client decodes it without catching Apache Thrift exceptions (TProtocolException, TTransportException or std::length_error), causing std::terminate() and terminating the whole process along with every other in-flight RPC.

Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. The parser recursively parses nested objects and arrays without any depth limit, leading to stack overflow and process crash.

Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sending a malformed stream feedback frame. Stream::SetRemoteConsumed() contains CHECK(_cur_buf_size > 0) and unconditionally asserts CHECK(buf.IsEmpty()) on the frame payload; a feedback frame with an unexpected payload or received on a stream with flow control disabled reaches these assertions, and CHECK failures abort the process.

A vulnerability in the streaming RPC component of Apache bRPC (versions < 1.18.0) allows a remote attacker to exhaust server memory and cause denial of service by sending a single RPC request that declares an excessive number of streams. The server creates one response stream per stream identifier in the extra_stream_ids field without limiting the number of streams accepted in a single RPC, and each stream allocates its own bthread execution queue and resources.

A vulnerability in Apache bRPC (versions < 1.18.0) allows unbounded memory accumulation in the stream message reassembly path. A remote attacker can send an endless sequence of continuation data frames to exhaust server memory, causing a denial of service.

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0). A client creating multiple streams in a single RPC indexes returned extra_stream_id values without first validating the returned list size, so a malicious or compromised server can return a malformed StreamSettings response with fewer identifiers and trigger an out-of-bounds read.

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) allows a remote attacker to bypass server authentication and inject or deliver streaming frames when a server is configured with an Authenticator. Streaming frames never pass through the authentication hook, and streams can be impersonated by another socket carrying the same id.

Resource exhaustion vulnerability in Apache bRPC versions before 1.18.0 affects multiple parsers that accept wire-controlled input. The gzip/zlib/snappy decompressors enforce no output limit, and the AMF, RTMP, sofa-pbrpc, and mcpack2pb parsers trust wire-declared sizes, allowing attackers to cause disproportionate memory use and crash the process.

Apache bRPC versions < 1.18.0 contain an uncontrolled resource consumption vulnerability in the HTTP/2 (h2) receive path. A remote unauthenticated attacker can send crafted HTTP/2 frames to crash the server or cause unbounded memory growth. The root cause is that receive-side limits (e.g., MAX_CONCURRENT_STREAMS, MAX_HEADER_LIST_SIZE) are advertised but never enforced, and control-frame acks bypass the write buffer cap.

A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) allows a remote attacker to crash the server process by sending a crafted sequence of HPACK headers, resulting in a denial of service. The root cause is an incorrect dynamic-table ring buffer sizing (34 instead of 33 bytes per entry), which leads to overflow and a CHECK abort.

A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a crafted Abort control message. When the Abort message names the chunk stream currently being parsed, the object is deleted while Feed() is still running, leading to use-after-free.

Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) allows remote attackers to make the server allocate a large amount of memory by sending a crafted mcpack request with a huge array item count. The parser trusts the item count from the header without validating it against the actual payload size, potentially preallocating about 16GB of virtual memory.

An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a request containing a string field with a zero value_size. The UnparsedValue::as_string() function computes `_size - 1` without validating `_size`; when value_size is 0 the expression underflows to SIZE_MAX, resize() throws std::length_error, and because the exception is not caught on the request parsing path the process aborts (SIGABRT).

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint.

An out-of-bounds read vulnerability exists in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned (e.g., ARM64). Input bytes with the high bit set (0x80–0xFF) are not normalized to the signed-char range, causing lookup-table indices in URL parsing and case-insensitive header lookup to exceed table bounds. This allows remote attackers to crash the process and cause denial of service via crafted input.

Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service.

The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminated command was available. A remote attacker with access to a Redis-protocol bRPC service could send long inline inputs without a terminating CRLF to increase memory usage and CPU copy overhead, potentially causing denial of service.

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.

The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker can send a small AMF payload with an excessive declared long string length or array count, causing excessive memory allocation before the parser rejects the incomplete payload.

Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload.

Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arrays. The parser recursively processed nested AMF containers without enforcing a depth limit, which could exhaust the native stack.

Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a deeply nested RESP array reply. The parser recursed once for each nested array level without enforcing a depth limit.

Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2 header block containing many consecutive Dynamic Table Size Update entries. Each update was decoded recursively, potentially exhausting the thread stack.

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are publicly exposed, the first builtin request may mark the connection as authenticated for later requests.

Uncontrolled recursion in the json2pb component of Apache bRPC (versions < 1.15.0) allows remote attackers to crash the server by sending deeply recursive JSON data. The root cause is the recursive rapidjson parser, which can cause stack overflow with deeply nested input.