PT-2023-23117 · Apache · Apache Brpc

Wang Weibing · Publicado 2023-05-08 · Atualizado 2024-10-15 · CVE-2023-31039

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.5.0

Description A security issue in Apache bRPC allows attackers to execute arbitrary code via the pid file parameter in ServerOptions. This can be exploited by an attacker who can influence the pid file parameter when the bRPC server is started, resulting in arbitrary code execution with the permissions of the bRPC process.

Recommendations For Apache bRPC versions prior to 1.5.0, upgrade to bRPC version 1.5.0 or later. If upgrading is difficult, apply the patch available at https://github.com/apache/brpc/pull/2218 as a temporary solution.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-31039

Produtos afetados

Apache Brpc

Referências · 5

• https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn · Aviso do Fabricante
• https://t.me/pentestingnews/35766 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-31039 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31039 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/05/08/1 · Correção