CVE-2023-45757: Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-16 · updated 2026-06-17
Weakness: CWE-79

Description

Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http request to bRPC server with rpcz enabled can inject arbitrary XSS code to the builtin rpcz page. Solution (choose one of three): 1. upgrade to bRPC > 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature

Affected products

Apache Software Foundation Apache bRPC: before 1.6.1 — fixed in 1.6.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache bRPC 1.6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-45757 or the next vulnerability affects your stack