Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-47248

CVE-2023-47248:
PyArrow: Arbitrary code execution when loading a malicious data file

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-47248
GHSA ID
GHSA-5wvp-7f3h-6wmm
EPSS Score
0.994%
CWE
CWE-502
Published
11/9/2023
Updated
10/21/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pyarrowpip>= 0.14.0, < 14.0.114.0.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from PyArrow's PyExtensionType using pickle-based deserialization without proper safeguards. The commit f141709 explicitly disables PyExtensionType autoloading by default and deprecates it, replacing it with safer ExtensionType handling. The arrow_ext_deserialize method in PyExtensionType was directly responsible for unpickling untrusted data, while set_auto_load governed the dangerous default behavior. These functions are clearly implicated in the CWE-502 deserialization vulnerability as they allowed execution of arbitrary code via malicious payloads in Arrow/IPC/Parquet files.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**s*ri*liz*tion o* untrust** **t* in IP* *n* P*rqu*t r****rs in Py*rrow v*rsions *.**.* to **.*.* *llows *r*itr*ry *o** *x**ution. *n *ppli**tion is vuln*r**l* i* it r***s *rrow IP*, ***t**r or P*rqu*t **t* *rom untrust** sour**s (*or *x*mpl* us*r-su

Reasoning

T** vuln*r**ility st*ms *rom Py*rrow's Py*xt*nsionTyp* usin* pi*kl*-**s** **s*ri*liz*tion wit*out prop*r s****u*r*s. T** *ommit ******* *xpli*itly *is**l*s Py*xt*nsionTyp* *utolo**in* *y ****ult *n* **pr***t*s it, r*pl**in* it wit* s***r *xt*nsionTyp