Exploit Tool Released for Critical Apache Parquet RCE Flaw

F5 Labs Releases Exploit Tool for Apache Parquet Vulnerability CVE-2025-30065

Cybersecurity researchers from F5 Labs have released a working proof-of-concept (PoC) exploit for a critical deserialization flaw in Apache Parquet, tracked as CVE-2025-30065. The release underscores the potential real-world impact of the vulnerability, despite its complex exploitation path.

Background: Critical Flaw in Widely Used Data Processing Format

Apache Parquet is a popular open-source columnar storage format used extensively in big data ecosystems such as Apache Hadoop, Spark, and Hive. The flaw, which affects all versions up to and including 1.15.0, was initially discovered by Amazon security researcher Keyi Li and disclosed on April 1, 2025.

The vulnerability resides in the parquet-avro module, which fails to restrict which Java classes can be instantiated when processing Avro data embedded in Parquet files. This makes it vulnerable to Java deserialization attacks, potentially leading to remote code execution (RCE) under specific conditions.

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

Technical Assessment: Limited, But Real Risk

While CVE-2025-30065 has been described as a maximum-severity flaw, F5 Labs clarified that it does not enable full RCE on its own. Instead, the flaw allows instantiation of arbitrary Java classes during deserialization—an issue that becomes dangerous only if one of those classes has a side effect, such as making a network request or performing an action beneficial to an attacker.

“Even then, this CVE only allows attackers to trigger the instantiation of a Java object which then must have a side effect that is useful for the attacker,” F5 Labs wrote in their analysis.

Nevertheless, the potential impact is significant in environments where Parquet files are imported from untrusted or external sources, a common scenario in data-sharing pipelines and analytics platforms.

Canary Exploit Tool Released for Exposure Testing

To help organizations determine whether they are affected, F5 Labs published a “canary exploit” tool on GitHub. This PoC uses a harmless but observable payload—instantiating the javax.swing.JEditorKit class—to trigger an outbound HTTP GET request, demonstrating that deserialization occurs and confirming exposure.

This tool is especially valuable given that previously released PoCs were often non-functional or unreliable, according to F5.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: bleepingcomputer.com

Source Link