threatradarai/trai-001-critical-rce-vulnerability-in-apache-parquet-cve-2025-30065-simulation
A CVSS 10.0-rated vulnerability in the parquet-avro Java module allows remote code execution via unsafe deserialization when parsing schemas. Tracked as CVE-2025-30065, this flaw affects Apache Parquet ≤ 1.15.0. All users must upgrade to version 1.15.1 immediately to mitigate exploitation risks.
Demo Screenshot
Simulator interface demonstrating the exploit chain
This repository contains an educational simulation of CVE-2025-30065, a critical Remote Code Execution vulnerability in Apache Parquet files. The tool demonstrates how attackers exploit this flaw to gain full system control, while providing mitigation guidance.
Key Features:
| Category | Description |
|---|
| CVE ID | CVE-2025-30065 |
| Affected | Apache Parquet <= 2.9.0 |
| CVSS Score | 10.0 (Critical) |
| Attack Vector | Malicious Parquet file upload |
| Impact | Remote Code Execution → Full System Compromise |
The vulnerability stems from:
1. Reconnaissance # Scan for vulnerable services
2. Exploitation # Deliver malicious Parquet file
3. Privilege Escalation # Elevate to root/admin
4. Data Exfiltration # Steal AWS creds, DB data, PII
├── app.py # Flask backend (simulation API)
├── static/
│ ├── script.js # Terminal & exploit logic
│ └── style.css # Dark theme styling
├── templates/
│ └── index.html # Interactive web interface
├── screenshots/ # Demo images
└── README.md
git clone https://github.com/yourusername/apache-parquet-rce-simulator.git
cd apache-parquet-rce-simulator
pip install flask
python app.py
Visit http://localhost:5000 to launch the interactive simulator.
Set Target
Configure IP (192.168.1.100) and port (8080)
Execute Phases
Click through each attack stage:
Review Results
1. Patching:
- Upgrade to Apache Parquet >= 1.15.1.
2. Defensive Measures:
- Disable unnecessary Parquet endpoints
- Implement file content validation
- Use network segmentation
3. Detection:
- Monitor for abnormal Parquet file processing
- Alert on thrift deserialization errors
This is a simulation tool only. It demonstrates attack methodology for educational purposes. Never use against real systems without permission.
NA