CVE-2025-30065

This repository illustrates how to exploit CVE-2025-30065 and achieve remote class instantiation and trigger a network request from within the victim application i.e the JVM thereby achieving SSRF.

The generated parquet in Malicious.java assumes that the class RCEPayload.java is present in the classpath which is not realistic. You can trigger that PoC by executing Reader.java.

MaliciousSSRF.java is more feasible (from an attacker perspective) and triggers a network connection which could be internal or external. One could also find other gadgets to achieve RCE (what is tricky is to find an instructor accepting a string as arg and leading to a RCE it is not like plain java deser). Similarly, PoC can be executed using ReaderSSRF.java.

For more details about the internal of the vulnerability and the fix, you can have a look at my blogpost: www.deep-kondah.com/parquet-under-fire-a-technical-analysis-of-cve-2025-30065