ID:12356 - Exploit for Improper Neutralization of Argument Delimiters in a Command in Apache bRPC - CVE-2025-60021

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to execute arbitrary OS commands on the system.

The vulnerability exists due to improper input validation within the bRPC heap profiler built-in service (/pprof/heap). A remote user can pass specially crafted input via the extra_options parameter and executes it as a command-line argument. 

Remediation