You can deploy this model and start earning money today!

xiaoyaoes/
parquet-cve-2023-47248-poc

Name: parquet-cve-2023-47248-poc
Availability: InStock

Views

No views yet

Parquet PyExtensionType RCE PoC (CVE-2023-47248)

MFV Target: #32 Parquet ($1500)

Mechanism: PyArrow's Parquet reader deserializes ARROW:schema metadata. If the schema contains arrow.py_extension_type, PyArrow's C++ layer calls pickle.loads() on the extension metadata, leading to RCE.

Impact: PyArrow 0.14.0 ~ 14.0.0

ModelScan: Blind - no .parquet support.

PoC file: malicious.parquet — triggers RCE when loaded via pq.read_table()

Usage:

python3 -c "import pyarrow.parquet as pq; pq.read_table('malicious.parquet')"

xiaoyaoes/parquet-cve-2023-47248-poc

Parquet PyExtensionType RCE PoC (CVE-2023-47248)

xiaoyaoes/
parquet-cve-2023-47248-poc