CVE-2023-47248 – This vulnerability allows arbitrary code execut... (How to Fix)

📋 TL;DR

This vulnerability allows arbitrary code execution when PyArrow processes untrusted Arrow IPC, Feather, or Parquet files. Applications that read these file formats from user-supplied sources are affected. Only PyArrow implementations are vulnerable, not other Apache Arrow bindings.

💻 Affected Systems

Products:

PyArrow

Versions: 0.14.0 to 14.0.0

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Only vulnerable when reading Arrow IPC, Feather, or Parquet files from untrusted sources. Other Apache Arrow implementations are not affected.

📦 What is this software?

Pyarrow by Apache

View all CVEs affecting Pyarrow →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote attacker gains full control of the system by uploading a malicious file that triggers deserialization exploit.

🟠

Likely Case

Attackers execute arbitrary code on servers processing user-uploaded data files, potentially leading to data theft, system compromise, or lateral movement.

🟢

If Mitigated

If input validation and file source restrictions are in place, impact is limited to denial of service or data corruption.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only file upload/processing capability. CVSS 9.8 indicates critical severity with easy exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 14.0.1

Vendor Advisory: https://lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n

Restart Required: No

Instructions:

1. Upgrade PyArrow to version 14.0.1 or later using pip: pip install --upgrade pyarrow==14.0.1
2. Update downstream library dependencies to require pyarrow>=14.0.1
3. Test application functionality after upgrade.

🔧 Temporary Workarounds

Install pyarrow-hotfix package

all

Disables the vulnerability on older PyArrow versions without upgrading

pip install pyarrow-hotfix

🧯 If You Can't Patch

Restrict file processing to trusted sources only - implement strict input validation and source whitelisting
Implement file type verification and reject Arrow IPC, Feather, and Parquet files from untrusted sources

🔍 How to Verify

Check if Vulnerable:

Check PyArrow version and if application processes Arrow IPC, Feather, or Parquet files from untrusted sources

Check Version:

python -c "import pyarrow; print(pyarrow.__version__)"

Verify Fix Applied:

Verify PyArrow version is 14.0.1 or later, or pyarrow-hotfix is installed

📡 Detection & Monitoring

Log Indicators:

Unexpected process execution after file processing
Errors in PyArrow deserialization logs
Unusual file upload patterns

Network Indicators:

Large or malformed file uploads to PyArrow processing endpoints

SIEM Query:

process.name:python AND process.args:*pyarrow* AND event.action:exec

📊 Metadata

CVE ID: CVE-2023-47248

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

Published: November 9, 2023

Last Updated: February 13, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-47248, you might also want to check these: