A proof-of-concept exploit instrument has been publicly launched for a most severity Apache Parquet vulnerability, tracked as CVE-2025-30065, making it straightforward to seek out weak servers.
The instrument was launched by F5 Labs researchers who investigated the vulnerability after discovering that a number of current PoCs had been both weak or fully non-functional.
The instrument serves as proof of CVE-2025-30065’s sensible exploitability and can even assist directors consider their environments and safe servers.
Apache Parquet is an open-source, columnar storage format designed for environment friendly information processing, broadly utilized by huge information platforms and organizations engaged in information engineering and analytics.
The flaw was first disclosed on April 1, 2025, following an earlier discovery by Amazon researcher Keyi Li. It was categorized as a distant code execution impacting all variations of Apache Parquet as much as and together with 1.15.0.
From a technical perspective, CVE-2025-30065 is a deserialization flaw within the parquet-avro module of Apache Parquet Java, the place the library fails to limit which Java lessons could be instantiated when studying Avro information embedded in Parquet information.
On April 2, 2025, Endor Labs revealed a write-up warning in regards to the danger of exploitation and its potential affect on methods that import Parquet information from exterior factors.
Subsequent evaluation by F5 Labs reveals that the flaw just isn’t a full deserialization RCE however can nonetheless be misused if a category has uncomfortable side effects throughout instantiation, like when making a community request from the weak system to an attacker-controlled server.
Nevertheless, the researchers concluded that sensible exploitation is troublesome, and CVE-2025-30065 has restricted worth to attackers.
“Whereas Parquet and Avro are used broadly, this situation requires a selected set of circumstances that is not all that probably generally,” reads the F5 Labs report.
“Even then, this CVE solely permits attackers to set off the instantiation of a Java object which then will need to have a facet impact that’s helpful for the attacker.”
Regardless of the low probability of exploitation, the researchers admit that some organizations course of Parquet information from exterior, usually unverified sources, and therefore the danger is important in some environments.
For that reason, F5 Labs created a “canary exploit” instrument (obtainable on GitHub) that triggers an HTTP GET request through instantiation of javax.swing.JEditorKit, permitting customers to confirm publicity.
In addition to utilizing the instrument, it’s endorsed to improve to Apache Parquet model 15.1.1 or later, and configure ‘org.apache.parquet.avro.SERIALIZABLE_PACKAGES’ to limit which packages are allowed for deserialization.
Based mostly on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and learn how to defend towards them.
