CVE-2023-31039 Apache bRPC: ServerOptions.pid_file may cause arbitrary code execution

2023-05-0808:57:14

CWE-20

apache

www.cve.org

apache

brpc

serveroptions

pid_file

arbitrary code execution

vulnerability

upgrade

patch

10 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.3%

JSON

Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file.
An attacker that can influence the ServerOptions pid_file parameter with which the bRPC server is started can execute arbitrary code with the permissions of the bRPC process.

Solution:

upgrade to bRPC >= 1.5.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.5.0/ https://dist.apache.org/repos/dist/release/brpc/1.5.0/
If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2218 https://github.com/apache/brpc/pull/2218

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache bRPC",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.5.0",
        "status": "affected",
        "version": "0.9.0",
        "versionType": "semver"
      }
    ]
  }
]