CVE-2024-52338
📋 TL;DR
This vulnerability allows arbitrary code execution through deserialization of untrusted data in Apache Arrow R package's IPC and Parquet readers. It affects R applications that read Arrow IPC, Feather, or Parquet files from untrusted sources. Only the arrow R package versions 4.0.0 through 16.1.0 are affected, not other Apache Arrow implementations.
💻 Affected Systems
- Apache Arrow R package
📦 What is this software?
Arrow by Apache
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to execute arbitrary commands, install malware, or exfiltrate data.
Likely Case
Arbitrary code execution in R environment when processing malicious data files, potentially leading to data theft or system compromise.
If Mitigated
No impact if proper controls prevent untrusted data processing or if workaround is implemented correctly.
🎯 Exploit Status
Exploitation requires the application to process attacker-controlled files. No authentication needed if application accepts file uploads or processes external data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 17.0.0
Vendor Advisory: https://lists.apache.org/thread/0rcbvj1gdp15lvm23zm601tjpq0k25vt
Restart Required: No
Instructions:
1. Update arrow package in R: install.packages('arrow', version='17.0.0'). 2. Restart R session. 3. Verify version with packageVersion('arrow'). 4. Update downstream library dependencies to require arrow >=17.0.0.
🔧 Temporary Workarounds
Use to_data_frame() workaround
allRead untrusted data into Table object first, then convert to data frame using internal method to avoid vulnerable deserialization path.
read_parquet('file.parquet', as_data_frame = FALSE)$to_data_frame()
read_feather('file.feather', as_data_frame = FALSE)$to_data_frame()
read_ipc_stream('file.arrow', as_data_frame = FALSE)$to_data_frame()
🧯 If You Can't Patch
- Implement strict input validation to reject untrusted Arrow/Feather/Parquet files
- Use the to_data_frame() workaround for all file reading operations
🔍 How to Verify
Check if Vulnerable:
Check arrow package version in R: packageVersion('arrow') >= 4.0.0 && packageVersion('arrow') <= 16.1.0Check Version:
packageVersion('arrow')Verify Fix Applied:
Confirm arrow package version is 17.0.0 or higher: packageVersion('arrow') >= 17.0.0📡 Detection & Monitoring
Log Indicators:
- Unusual R process spawning child processes
- Abnormal file system access from R processes
- Errors in arrow package deserialization
Network Indicators:
- Outbound connections from R processes to unexpected destinations
- Data exfiltration patterns from systems running R
SIEM Query:
process.name: 'Rscript' OR process.name: 'R' AND (process.cmdline: '*arrow*' OR process.cmdline: '*parquet*' OR process.cmdline: '*feather*')