Max severity RCE flaw discovered in widely used Apache Parquet

As per the PoC, yes — this is the usual Java Deserialization RCE where it’ll instantiate arbitrary classes. Java serialization really is a gift that keeps on giving.

I love how these always instantly escalate into trivial code execution / reverse shell. Remember kids, C is the enemy!

The "fix" in question also screams "delete this crap immediately": https://github.com/wgtmac/parquet-mr/commit/d185f867c1eb968a...

The fix still loads the class before checking if it’s okay.

That’s a smaller attack window but it’s still not zero.

Java reflection can load classes without initializing them, so no untrusted code would have to be executed at that point.

I haven’t been in Java for a good while. When did they do that?

Static initializers used to load on Classloader calls.

An overload for Class.forName with an explicit initialize parameter was added in Java 1.2 .