A proof-of-concept exploit has been publicly launched for a most severity Apache Parquet vulnerability, tracked as CVE-2025-30065, making it simple to seek out weak servers.
The device was launched by F5 Labs researchers who investigated the vulnerability after discovering that a number of current PoCs have been both weak or utterly non-functional.
The device serves as proof of CVE-2025-30065’s sensible exploitability and may assist directors consider their environments and safe servers.
Apache Parquet is an open-source, columnar storage format designed for environment friendly knowledge processing, broadly utilized by large knowledge platforms and organizations engaged in knowledge engineering and analytics.
The flaw was first disclosed on April 1, 2025, following an earlier discovery by Amazon researcher Keyi Li. It was categorized as a distant code execution impacting all variations of Apache Parquet as much as and together with 1.15.0.
From a technical perspective, CVE-2025-30065 is a deserialization flaw within the parquet-avro module of Apache Parquet Java, the place the library fails to limit which Java courses will be instantiated when studying Avro knowledge embedded in Parquet information.
On April 2, 2025, Endor Labs printed a write-up warning in regards to the danger of exploitation and its potential impression on methods that import Parquet information from exterior factors.
Subsequent evaluation by F5 Labs reveals that the flaw isn’t a full deserialization RCE however can nonetheless be misused if a category has uncomfortable side effects throughout instantiation, like when making a community request from the weak system to an attacker-controlled server.
Nevertheless, the researchers concluded that sensible exploitation is tough, and CVE-2025-30065 has restricted worth to attackers.
“Whereas Parquet and Avro are used broadly, this concern requires a selected set of circumstances that is not all that probably generally,” reads the F5 Labs report.
“Even then, this CVE solely permits attackers to set off the instantiation of a Java object which then will need to have a aspect impact that’s helpful for the attacker.”
Regardless of the low probability of exploitation, the researchers admit that some organizations course of Parquet information from exterior, typically unverified sources, and therefore the danger is important in some environments.
For that reason, F5 Labs created a “canary exploit” device (out there on GitHub) that triggers an HTTP GET request through instantiation of javax.swing.JEditorKit, permitting customers to confirm publicity.
In addition to utilizing the device, it is strongly recommended to improve to Apache Parquet model 15.1.1 or later, and configure ‘org.apache.parquet.avro.SERIALIZABLE_PACKAGES’ to limit which packages are allowed for deserialization.
Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and the best way to defend in opposition to them.
