Apache Parquet Hadoop versions 1.12 through 1.18.0 contain a high-severity vulnerability that could allow attackers to intercept sensitive KMS tokens through improper input validation.

This vulnerability involves improper input validation (CWE-20) within the org.apache.parquet.crypto.keytools package. When an application fails to enforce strict control over the KMS URL parameter, the system may process a file-controlled URL, allowing an attacker to forward KMS tokens to a malicious host if the KmsClient implementation lacks host validation.

The exploitation of this flaw could lead to the unauthorized interception of cryptographic keys, effectively compromising the confidentiality and integrity of encrypted Parquet files. Given the CVSS score of 8.1, this vulnerability poses a significant risk to data privacy, especially in environments where sensitive information is stored in Hadoop-based data lakes. Successful exploitation could result in widespread data exposure and potential regulatory non-compliance.

Immediate Action: Until an official patch is available, organizations must enforce application-level control for the KMS URL parameter in all reader implementations to prevent the use of file-controlled URLs.

Proactive Monitoring: Review application logs for unusual KMS connection attempts or requests directed toward unknown or unauthorized external hostnames.

Compensating Controls: Implement strict network egress filtering to prevent internal servers from communicating with unauthorized or untrusted KMS endpoints.

Public Exploit Available: Unknown

This vulnerability presents a high risk to data security due to the potential for credential theft. Administrators should prioritize the implementation of application-level KMS URL controls immediately. Once the vendor releases version 1.19 or the relevant security update, it should be applied as soon as it passes internal testing to ensure the insecure file-controlled KMS behavior is disabled by default.