CVE-2025-30065

CVE-2025-30065 研究笔记 此仓库刻意保持小巧且可读性高。它旨在用于对 Apache Parquet / Avro 模式处理中的 CVE-2025-30065 进行授权安全研究、本地验证和防御性研究。 本 README 侧重于仓库卫生、构建可复现性和安全使用。它不提供可操作的漏洞利用指导。 仓库内容 一个基于 Java 的研究框架。 一组用于在受控实验室中研究此漏洞的少量源文件。 一个 Maven 构建定义。 一个辅助脚本，用于在本地编译和运行项目。 前提条件 Java 8 或更新版本。 Maven。 一个您拥有或得到明确授权使用的受控测试环境。 构建和运行 chmod +x...

parquet-rce-poc-CVE-2025-30065

CVE-2025-30065 本仓库演示了如何利用 CVE-2025-30065 实现远程类实例化，并在受害者应用程序（即 JVM）内部触发网络请求，从而实现 SSRF。 Malicious.java 生成的 parquet 文件假定类 RCEPayload.java 已存在于类路径中，但这并不现实。你可以通过执行 Reader.java 来触发该 PoC。 MaliciousSSRF.java 从攻击者的角度来看更为可行，它会触发一个网络连接，该连接可以是内网或外网的。 还可以寻找其他 gadget 来实现 RCE（难点在于找到一个接受字符串作为参数并导向 RCE 的指令，这不像普通的...

CVE-2025-30065

💥 CVE-2025-30065 - Parquet 反序列化 PoC 该项目演示了 CVE-2025-30065 的安全概念验证，利用 Apache Parquet 和 Java 反序列化。 当读取包含序列化 Java 对象的 Parquet 文件时，负载会执行一条可见命令以证明代码执行。 📦 使用方法 生成 Parquet 负载： docker-compose run --rm maven-parquet mvn compile exec:java -Dexec.mainClass=ParquetPayloadWriter docker-compose run --rm...

TRAI-001-Critical-RCE-Vulnerability-in-Apache-Parquet-CVE-2025-30065-Simulation

TRAI-001 CVE-2025-30065：Apache Parquet 远程代码执行（RCE）漏洞模拟器 演示截图 演示模拟器界面展示漏洞利用链 📌 概述 本仓库包含针对 CVE-2025-30065（Apache Parquet 文件中的严重远程代码执行漏洞）的教学模拟器 。该工具演示攻击者如何利用此漏洞完全控制系统，同时提供缓解指南。 主要特点： 交互式分步漏洞利用模拟 带日志记录的逼真终端输出 漏洞详情与缓解策略 安全、无害的环境（无实际利用） 🚨 漏洞详情 类别| 描述 ---|--- CVE ID| CVE-2025-30065 受影响版本| Apache Parquet...

CVE-2025-30065-PoC

CVE-2025-30065 PoC 使用方法 构建镜像 docker build -t cve-2025-30065 . 生成恶意 Parquet 文件 docker run --rm -v $pwd:/poc/out cve-2025-30065 generate "cat /etc/passwd" ./out/malicious.parquet 触发漏洞利用 docker run --rm -v $pwd:/poc/out cve-2025-30065 trigger ./out/malicious.parquet...

parquet-canary-exploit-rce-poc-CVE-2025-30065

Parquet CVE-2025-30065 的 Canary 漏洞利用 -. '-. OO OO .-----,--/ ,. ,------. .-----. .----. .-----..------. .-----. .----. .----. ,--. .------. ' .--.\ \ //| .---' .-'/ ,-. / .. / ,-. | | .-' / -. / .. \ / .. \ / .' | | | |'-.\ \ / / | | OO'-' | . / \ '-' | | '--. OO'-' ' . / \ . / \ . / -. | '--. /...

parquet-avro-rce

Este repositorio no tiene un README...

Host Validation Bypass

Apache Parquet is vulnerable to host validation bypass. The vulnerability is due to the pluggable KmsClient implementation not performing host validation for a file‑controlled KMS URL, where the URL from the Parquet file is forwarded without checks and a malicious actor can inject a hostile host,...

shaha

shaha Hash database builder and reverse lookup tool. SHA + aha! Build precomputed hash databases from wordlists, then query them to find preimages. Installation root@kitploit: cargo install shaha Or build from source: root@kitploit: git clone https://github.com/oritwoen/shaha cd shaha cargo build...

CVE-2026-73334

A flaw was found in Apache Parquet Hadoop. When processing a Parquet file, if the Key Management Service KMS Uniform Resource Locator URL is controlled by the file and not explicitly set by the application, a vulnerability can arise. An attacker could craft a malicious Parquet file to direct a KM...

CVE-2026-73334

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-73334

The org.apache.parquet.crypto.keytools package in Apache Parquet (versions 1.12 to 1.18) is vulnerable to a Server-side Request Forgery (SSRF) due to a host validation bypass. When the KMS URL is file-controlled rather than application-controlled, the FileKeyUnwrapper forwards the URL to a plugga...

EUVD-2026-74804

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through FileKeyUnwrapper in parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java. An attacker can make a reader send its KMS access token to an attacker-controlled host b...

PT-2026-88925

Name of the Vulnerable Software and Affected Versions Apache Parquet versions 1.12 through 1.18 Description The org.apache.parquet.crypto.keytools package allows for the encryption of Parquet files using an envelope encryption mechanism that wraps data keys via a Key Management Service KMS. When...

CVE-2026-73334: Improper Input Validation

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...

ANT-2026-QRPT15J8 · duckdb · Stack-buffer-overflow

stack-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-QRPT15J8: Stack-buffer-overflow in...

JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...