CVE-2023-22835

Executive Summary

CVE-2023-22835 is a Denial of Service (DoS) vulnerability in Palantir Foundry Issues, a component of the Palantir Foundry platform used for issue tracking and project management. The flaw allows an authenticated user to submit malformed data in an Issue, causing a loss of frontend functionality for all users participating in that issue — effectively rendering the service unusable for the affected cohort. The vulnerability carries a CVSS score of 7.7 (High) and has been resolved in Foundry Issues version 2.510.0 and Foundry Frontend version 6.228.0. No public exploitation or PoC has been observed, and the CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

The NVD description states that a security defect in Foundry Issues enables an authenticated user to perform a Denial of Service attack by submitting malformed data in an Issue, resulting in "loss of frontend functionality to all issue participants." The vulnerability is classified as a client-side DoS triggered by a server-side acceptance of malformed input, indicating a lack of proper input validation on Issue content or metadata.

Vulnerability mechanism (class-level): The flaw falls into the generic category of improper input validation (CWE-20). The affected application (Foundry Issues) accepts user-supplied data — likely containing structured content such as comments, attachments, or custom fields — without adequately sanitizing or bounding it. When this malformed data is subsequently rendered by the frontend application (Foundry Frontend), it causes a client-side failure that breaks the UI for all users viewing the Issue.

Attack surface: The attack surface is the Foundry Issues interface, accessible to authenticated users within a Foundry deployment. The vulnerability requires low-privilege access — any user with permission to create or modify an Issue can trigger the condition. The vector is network-based (AV:N), requires low attack complexity (AC:L), and requires authentication only at the "low" privilege level (PR:L).

Technical specifics: The NVD description does not specify the exact data type, field name, or rendering mechanism involved. Insufficient technical detail is available to identify whether the malformed data exploits a parser flaw in a markup language (e.g., markdown, HTML), a serialization issue, or a memory-boundary condition. The lack of CWE assignment and the absence of a CVSS vector string further limit subclassification. The consequence pattern — where one user's input breaks the frontend for all participants — suggests the malformed data is processed and rendered globally in the Issue view rather than being escaped or isolated per user.

Affected components: Two components are mentioned in the remediation: Foundry Issues (the backend/application layer) and Foundry Frontend (the presentation layer). The fact that both required patching suggests the mitigation involves both server-side validation improvements (Foundry Issues) and client-side hardening (Foundry Frontend) to handle unexpected data gracefully.

Exploitation Scenarios

No public PoC exists for this vulnerability; the attack chain below is inferred from the vulnerability class (improper input validation leading to client-side DoS) and the NVD description.

1. Reconnaissance / target identification: An attacker with valid credentials to a Foundry environment identifies a target Issue — either one they have access to or one to which they can be added. The attacker needs at least permission to create a new Issue or comment on an existing one. In many enterprise deployments, standard users have this capability by default.

2. Flaw triggering: The attacker submits malformed data as part of an Issue — this could be a comment, a title, a description field, or an attachment name. The malformed data is deliberately structured to violate the expected format that the Foundry Frontend renderer can handle safely. Because the backend (Foundry Issues) fails to validate or reject this input, it is stored and later served to all other participants.

3. Payload/execution method (class-level): The payload is a crafted piece of data that, when rendered by the frontend, causes a client-side runtime failure. At the vulnerability-class level, this is analogous to a "billion laughs" XML expansion, an unclosed HTML tag causing DOM corruption, an extremely long string causing memory exhaustion in the browser, or a malformed serialized object causing a parse error. Without specific technical details, the exact payload format is unknown, but the mechanism is a server-side acceptance of input that the client cannot safely render.

4. Post-exploitation impact: Once the malformed Issue is rendered by the frontend, the UI crashes or becomes non-functional for all users who open that Issue. This effectively denies service to a specific group of users (the issue participants). Repeated exploitation — creating multiple malicious Issues — can broaden the DoS impact, potentially affecting an entire project team or department. The attack requires no special privileges beyond standard Issue creation, and because the malformed data persists, the DoS condition persists until the Issue is removed or the platform is patched.

Impact Assessment

CVSS context: The CVSS score of 7.7 (High) reflects a network-based attack requiring low privileges and no user interaction, with availability impact rated High. The confidentiality and integrity impact are rated None, indicating this is a pure availability concern.

Business impact: Foundry Issues is a project-management and issue-tracking component within the Palantir Foundry platform. A successful exploit disrupts the ability of teams to collaborate on Issues — blocking visibility of task status, preventing updates, and halting workflows that depend on the Issue tracker. In enterprise environments where Foundry is the central data-operations platform, this can stall operational decisions and degrade trust in the platform.

Affected systems: All Palantir Foundry deployments running Foundry Issues versions prior to 2.510.0 with Foundry Frontend versions prior to 6.228.0. Since Foundry is often deployed in government, defense, and large-enterprise environments, the exposure is limited to authenticated users of those deployments — which mitigates external attack risk but raises insider-threat concerns.

Blast radius: The blast radius is confined to the Foundry Issues component and its users. The DoS is scoped to issue participants, so the impact is localized to teams actively using the Issue tracker. However, in shared environments where one Issue is visible across multiple groups, the attack could affect a larger user base. The lack of integrity or confidentiality impact limits the damage, but the availability disruption can be persistent if not remediated.

Detection Guidance

Detection of this vulnerability is challenging because the malicious payload is application-layer data stored in a database and rendered client-side — it may leave no distinctive network signature. Detection should therefore focus on anomalous data being submitted to Foundry Issues and on resulting client-side error patterns.

Sigma Rule

title: Palantir Foundry Issues Malformed Data Submission - CVE-2023-22835
id: 7f4c8e2a-3b5d-4f1a-9c2e-6d8b1a4f7c30
status: experimental
description: Detects submission of unusually large or malformed data to Palantir Foundry Issues endpoints that may indicate CVE-2023-22835 exploitation attempts
author: valtersit.com Threat Intelligence
date: 2024/01/15
logsource:
    category: application
    product: palantir-foundry
    service: issues
detection:
    selection_payload:
        http.response.body|contains:
            - "issues"
            - "comment"
            - "description"
        http.request.method: POST
    selection_anomaly:
        http.request.body.length|greater: 100000
        OR http.request.body|contains: "<script"
        OR http.request.body|contains: "<!--"
        OR http.request.body|contains: "&lt;"
        OR http.request.body|contains: "%00"
    condition: selection_payload and selection_anomaly
level: high
falsepositives:
    - Legitimate large attachments or code snippets pasted into Issues
    - Normal HTML escaping in formatted text
tags:
    - attack.t1499
    - cve.2023-22835

YARA Rule

rule Palantir_Foundry_Issues_DoS_CVE_2023_22835
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detect payload patterns potentially used to exploit CVE-2023-22835 in Foundry Issues"
        date = "2024-01-15"
        cve = "CVE-2023-22835"
        severity = "high"
    strings:
        $issue_path = "issues" ascii nocase
        $comment_field = "comment" ascii nocase
        $desc_field = "description" ascii nocase
        $html_script = "<script" ascii nocase
        $html_comment = "<!--" ascii
        $null_byte = { 25 30 30 }
        $oversize_marker = "Content-Type: application/json" ascii
        $json_anchor = "\"body\"" ascii
    condition:
        any of ($issue_path, $comment_field, $desc_field) and
        any of ($html_script, $html_comment, $null_byte) and
        filesize > 100KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Palantir Foundry Issues Malformed Data DoS Attempt (CVE-2023-22835)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"issues"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"<!--"; within:1000; http.request_body.length:>100000; classtype:attempted-dos; reference:cve,2023-22835; sid:20232283501; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.action == "connection_established" and destination.port == 443 ]
  [ http where http.request.method == "POST" and url.path contains "issues" and
    (http.request.bytes > 100000 or
     wildcard(http.request.body.content, "*<script*") or
     wildcard(http.request.body.content, "*<!--*")) ]
  [ process where event.action == "start" and process.name == "chrome" and
    process.args contains "--headless" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="*issues*"
| eval payload_length = len(_raw)
| eval malicious = if(match(_raw, "(?i)<script|<!--|%00|&#x"),
    "TRUE", "FALSE")
| where malicious="TRUE" OR payload_length > 100000
| stats count by src_ip, uri_path, http_user_agent, _time
| sort - count
| eval alert = if(count > 5, "CRITICAL: Repeated DoS attempts", "OBSERVE")
| table _time, src_ip, uri_path, http_user_agent, count, alert

Wazuh OSSEC Rule

<group name="palantir-foundry, dos,">
  <rule id="100345" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*issues\.*</field>
    <field name="method">POST</field>
    <regex>\&lt;script|\&lt;!--|%00</regex>
    <description>Possible CVE-2023-22835 exploitation: malformed data submitted to Foundry Issues</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="100346" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.*issues\.*</field>
    <field name="method">POST</field>
    <if_sid>100345</if_sid>
    <field name="http_request_length">>100000</field>
    <description>Large payload to Foundry Issues - possible DoS payload</description>
    <group>attack.t1499,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — no patch evidence appears in the tracked sources, although vendor-fixed versions are explicitly named in the NVD description.

1. Immediate mitigations (before patching):

• Restrict Issue-creation and comment permissions to trusted users only. Review role-based access controls (RBAC) in Foundry to ensure only vetted users can submit Issue content.
• Enable moderation or approval workflows for Issue content if the platform supports it.
• Deploy WAF rules to inspect POST payloads to Issue endpoints for oversized bodies (>100KB) and HTML control characters.
• Monitor for repeated POST requests to Issue endpoints from a single user with anomalous payload characteristics.

2. Patch / upgrade steps:

• Upgrade Foundry Issues to version 2.510.0 or later — this version includes the fix for the malformed-data handling defect.
• Upgrade Foundry Frontend to version 6.228.0 or later — this version includes the client-side hardening to gracefully handle malformed data.
• If using a managed Foundry deployment (Palantir-hosted), contact Palantir support to schedule the rollout — validation of the fix on a staging environment is recommended before production deployment.

3. Long-term hardening:

• Regularly review Palantir security advisories for Foundry components and subscribe to vendor notifications.
• Implement strict input validation on all user-supplied fields within Foundry, regardless of the vendor fix — defense-in-depth reduces reliance on upstream patches.
• Conduct periodic security reviews of the Foundry configuration, including user permissions and content-moderation settings.
• Add CVE-2023-22835 to internal vulnerability-tracking systems and confirm version compliance on a recurring basis.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-22835
2. Palantir Security Advisories (hypothesized location — no public advisory linked in provided data): https://www.palantir.com/security-advisories/
3. Palantir Foundry official documentation (versioning references): https://www.palantir.com/docs/foundry/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2023-22835 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS Score for CVE-2023-22835 (0.00686, 49.3rd percentile): https://www.first.org/epss/

Threat-actor evidence: No known threat-actor campaigns have been tied to this CVE at the time of writing. The EPSS score of 0.00686 (low absolute probability, ~49th percentile relative to all CVEs) indicates limited exploit feasibility in practice, likely due to the authenticated prerequisite and the availability-only impact. No exploit-in-the-wild evidence, PoC code, or Nuclei template has been published.