Apache CarbonData is an open-source, indexed columnar data storage format and database management system designed for fast interactive analytics on petabyte-scale big data platforms like Apache Hadoop and Apache Spark.
Apache CarbonData suffer from a Java deserialization vulnerability on the Distributed Index Server. The IndexInputFormat Writable read over the Hadoop IPC endpoint deserializes a wire blob (filterResolverBytes) through a ClassLoaderObjectInputStream with no ObjectInputFilter, so under the default SIMPLE Hadoop authentication a remote attacker who can reach the endpoint can have an arbitrary attacker-named class deserialized. This becomes RCE when a gadget class is on the server classpath, plausible via the Spark/Hadoop dependencies CarbonData ships with.