PT-2023-23117 · Apache · Apache Brpc

Wang Weibing · Published 2023-05-08 · Updated 2024-10-15 · CVE-2023-31039

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.5.0

Description A security issue in Apache bRPC allows attackers to execute arbitrary code via the pid file parameter in ServerOptions. This can be exploited by an attacker who can influence the pid file parameter when the bRPC server is started, resulting in arbitrary code execution with the permissions of the bRPC process.

Recommendations For Apache bRPC versions prior to 1.5.0, upgrade to bRPC version 1.5.0 or later. If upgrading is difficult, apply the patch available at https://github.com/apache/brpc/pull/2218 as a temporary solution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-31039

Affected Products

Apache Brpc

References · 5

• https://lists.apache.org/thread/jqpttrqbc38yhckgp67xk399hqxnz7jn · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31039 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31039 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/05/08/1 · Patch
• https://t.me/pentestingnews/35766 · Telegram Post