External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate\/overwrite files with the privileges of the server process, or to hold the process-wide CPU\/contention profiler for an arbitrarily long time.<\/p>\n
Root Cause:
\n1. The builtin \/flags service allows gflags carrying a validator to be modified at runtime via ?setvalue=. The bvar\/mbvar dump path gflags (bvar_dump_file, bvar_dump_tabs, mbvar_dump_file) were registered with an accept-anything validator whose only purpose was to wake the dumping thread. A remote attacker could therefore repoint the dump path (e.g. GET \/flags\/bvar_dump_file?setvalue=\/victim\/dir\/target followed by GET \/flags\/bvar_dump?setvalue=true, or the equivalent for mbvar_dump_file, which is used verbatim without a forced suffix), making the dumping thread recursively create directories and open\/truncate files at attacker-chosen locations. Tab names in bvar_dump_tabs were appended to the path without sanitization, allowing '..' to escape the configured directory.
\n2. The \/pprof builtin service did not clamp the ?seconds= parameter to FLAGS_max_profiling_seconds (a limit that \/hotspots enforced). A single request such as ?seconds=2147483647 made the handler sleep for decades while holding the process-wide gperftools CPU profiler or bthread contention profiler, so \/hotspots\/cpu and \/hotspots\/contention returned 503 for everyone else during that time.<\/p>\n
Affected Scenarios:
\nAny Apache bRPC server exposing the builtin services (enabled by default on the same port as normal RPC traffic) to untrusted networks.<\/p>\n
How to Fix:
\n(Choose one of the following options)
\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.
\n2. Apply this patch: https:\/\/github.com\/apache\/brpc\/pull\/3523 <\/p>\n
Note:
\nAfter the fix, bvar_dump_file, bvar_dump_tabs and mbvar_dump_file can no longer be modified at runtime through the \/flags builtin service. They can still be changed programmatically via google::SetCommandLineOption(), taking effect on the next dump cycle. The profiling duration of \/pprof is now capped by the -max_profiling_seconds gflag (default 300 seconds), which can be adjusted by the server owner.<\/p>\n","protected":false},"excerpt":{"rendered":"
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-44083","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/44083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=44083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=44083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=44083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}