CVE-2023-30945

Executive Summary

CVE-2023-30945 is a critical (CVSS 9.8) unauthenticated arbitrary file read/write vulnerability affecting multiple Palantir services, including Video History Server (VHS), Video Clip Distributor (VCD), and Clips2. The root cause is missing input validation on filenames, enabling a remote, unauthenticated attacker to read sensitive files from the host filesystem, overwrite existing files, or delete arbitrary files. As of the intelligence cutoff, no patch has been identified from any tracked source, and no public exploit or PoC has been disclosed, but the vulnerability class is inherently high-risk given the capability for both data exfiltration and persistent corruption of the affected services.

Technical Analysis

The NVD description attributes the vulnerability to "missing input validation on filenames" across three named Palantir services: Video History Server (VHS), Video Clip Distributor (VCD), and Clips2. The vulnerability class aligns with a path traversal / arbitrary file operations flaw (CWE-22), where user-supplied filenames are passed to filesystem APIs without proper sanitization of path separators, directory traversal sequences (../), or absolute path indicators.

Because the flaw is present in multiple services, it is likely inherited from a shared library or common file-handling component used by VHS, VCD, and Clips2. The mechanism would permit an attacker to manipulate the filename parameter in an HTTP request to escape the intended storage directory (e.g., a video clip repository) and reference arbitrary paths on the underlying operating system. The "write/delete" capability elevates this from a simple info-leak to a file corruption and potential remote code execution vector if the attacker can overwrite executable files or configuration files that are later loaded by the service.

Access control is absent — the vulnerability is explicitly "unauthenticated," meaning no API key, session token, or certificate is required to trigger the flaw. The missing validation likely occurs at the application layer before any authorization check, or the vulnerable endpoints are exposed on internal networks without authentication in the default deployment.

The attack surface is any network-exposed deployment of Palantir services that includes VHS, VCD, or Clips2. These services are part of Palantir's video-management infrastructure, commonly deployed in operational environments (e.g., government, defense, and critical infrastructure), which amplifies the severity. The CVSS vector reflects network exploitability (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). The EPSS score of 0.00726 (50.7th percentile) indicates moderate exploitation likelihood relative to the broader CVE pool, but the lack of a patch means this score will likely rise as scanning activity increases.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Only the service names (VHS, VCD, Clips2) and the flaw class (filename validation failure) are taken as fact; all endpoint paths and payload details are hypothetical or class-level descriptions.

1. Reconnaissance / Target Identification: An attacker identifies internet-exposed Palantir deployments by scanning for known web application fingerprints (e.g., specific HTTP response headers, login pages, or default ports used by Foundry/Gotham components). Shodan/Censys queries such as product:Palantir or banner searches for "Palantir" would surface candidate targets. The attacker enumerates service endpoints to locate VHS, VCD, or Clips2 interfaces, possibly via directory brute-forcing or by analyzing publicly available Palantir documentation for service paths.

2. Flaw Trigger: The attacker crafts an HTTP request to a file-serving or file-upload endpoint of one of the three services, supplying a filename parameter containing traversal sequences (e.g., ../../../etc/passwd). Because input validation on the filename is missing, the application constructs a filesystem path by concatenating a base directory with the user-supplied value without normalizing or rejecting traversal characters. The request is sent without any authentication, exploiting the unauthenticated nature of the vulnerable endpoint.

3. Payload / Execution Method: For file read: the attacker requests the traversed filename and receives the file contents in the HTTP response. For file write: the attacker submits a write request (e.g., multipart upload or POST body) with a filename pointing to a target path such as a webroot file, an SSH authorized_keys file, or a cron script. For file delete: the attacker issues a delete request with a traversed path to remove configuration files, logs, or database files. No authentication or session is required at any step.

4. Post-Exploitation Impact: A successful file read yields sensitive data — credentials, API keys, source code, or configuration secrets — enabling lateral movement or credential reuse. A successful write can overwrite an application script or configuration to achieve remote code execution or persistent backdooring. A successful delete can cause denial of service by removing critical service files or corrupting the video storage index. In a Palantir context, the compromised service may be part of a larger Foundry/Gotham deployment, giving the attacker a foothold on internal corporate or operational networks.

Impact Assessment

The CVSS base score of 9.8 (Critical) reflects the full impact triad: high confidentiality loss (arbitrary file read exposes secrets, credentials, and user data), high integrity loss (arbitrary file write permits service manipulation, ransomware-style file encryption, or backdoor installation), and high availability loss (arbitrary file delete can crash services or corrupt the video clip database). The unauthenticated, network-reachable trigger (AV:N/AC:L/PR:N/UI:N) removes all friction for remote attackers.

Affected systems are Palantir deployments running the VHS, VCD, or Clips2 services. These are not general-purpose web apps; they are purpose-built video-history and clip-distribution components used in surveillance, intelligence, and operational command centers. A compromise of these services could expose sensitive video footage, operational metadata, or the underlying Linux/Windows filesystem of the host. Given Palantir's typical deployment in high-security environments (defense, law enforcement, critical infrastructure), the blast radius extends beyond the service itself to the host OS and any neighboring systems on the internal network that rely on the host's security perimeter.

The absence of a patch (paid-listing confidence 0/4) means every affected deployment is currently vulnerable. Workarounds are also unavailable from the vendor, leaving network-level access controls as the sole interim defense. The write/delete capability distinguishes this from a mere info-leak vulnerability; it enables destructive and persistent attacks, elevating the urgency even in the absence of a known in-the-wild exploit.

Detection Guidance

Detection rules below are crafted for the vulnerability class (unauthenticated path traversal / arbitrary file access) and are service-agnostic; adjust field names to match your data sources.

Sigma Rule

title: Palantir VHS/VCD/Clips2 Unauthenticated Arbitrary File Access
id: 3f2c9a1e-7b4d-4f87-9a3c-6d1e5b2c8f4a
status: experimental
description: Detects HTTP requests to Palantir video services with path traversal sequences in filename parameters
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-30945
author: Valters IT Threat Intel
date: 2024/01/15
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '/../'
            - '\\..\\'
        cs-uri-query|contains|any:
            - 'vhs'
            - 'vcd'
            - 'clips2'
        cs-method:
            - 'GET'
            - 'POST'
            - 'DELETE'
            - 'PUT'
    filter:
        sc-status: 401
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate use of traversal sequences in encoded data (rare)
tags:
    - attack.t1190
    - cve.2023-30945

YARA Rule

rule CVE_2023_30945_Palantir_File_Traversal
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects requests targeting Palantir VHS/VCD/Clips2 with traversal patterns"
        cve = "CVE-2023-30945"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-30945"
    strings:
        $srv1 = "vhs" nocase
        $srv2 = "vcd" nocase
        $srv3 = "clips2" nocase
        $trv1 = "..%2f"
        $trv2 = "..%5c"
        $trv3 = "/../"
        $trv4 = "\\..\\"
        $ext = "filename=" nocase
    condition:
        (any of ($srv*) or any of ($trv*)) and $ext and filesize < 5KB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-30945 Palantir VHS/VCD/Clips2 Unauthenticated File Traversal Attempt"; flow:established,to_server; http.uri; content:"..%2f"; http.uri; content:"..%5c"; http.uri; content:"/../"; http.uri; content:"filename="; http.method; content:"GET"; http.method; content:"POST"; http.method; content:"DELETE"; http.method; content:"PUT"; classtype:attempted-admin; sid:5000450; rev:1; reference:cve,2023-30945; priority:1;)

Elastic Detection

sequence by source.ip with maxspan=15s
  [network where dns.question.name like "*.palantir*" or destination.port in (443, 80)]
  [http where http.request.method in ("GET", "POST", "DELETE", "PUT") and (
     http.request.uri like "*..%2f*" or http.request.uri like "*..%5c*" or
     http.request.uri like "*vhs*" or http.request.uri like "*vcd*" or
     http.request.uri like "*clips2*") and http.request.uri like "*filename=*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)(vhs|vcd|clips2)")
| where match(uri, "(\.\.(%2f|%5c)|/\.\./|\\\.\.\\)")
  AND match(uri, "(?i)filename=")
  AND method IN ("GET","POST","DELETE","PUT")
| table _time, src_ip, dest_ip, method, uri, status
| eval severity = "high"
| stats count by src_ip, dest_ip, method

Wazuh OSSEC Rule

<group name="palantir,">
  <rule id="100450" level="15">
    <decoded_as>web</decoded_as>
    <match>..%2f|..%5c|/../|\\..\\</match>
    <match>vhs|vcd|clips2</match>
    <match>filename=</match>
    <description>CVE-2023-30945: Attempted unauthenticated file traversal on Palantir video service</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2023-30945</info>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, commit, version, or fix has been identified from any tracked source. The vendor has provided no official mitigation or workaround guidance. The following recommendations are interim hardening steps based on the vulnerability class.

1. Immediate Mitigations (compensating controls):

   • Restrict network access to VHS, VCD, and Clips2 services using firewall rules or security groups. Allow only trusted internal IP ranges (e.g., SOC or operations subnets) to reach these services. Disable internet exposure entirely where possible.
   • Place a Web Application Firewall (WAF) in front of Palantir services with rules to block URI paths containing ../, encoded variants (%2e%2e%2f, %252e%252e%252f), or double-encoded sequences, and to reject any request with a filename parameter containing a path separator.
   • Enforce mandatory authentication at a reverse proxy layer (e.g., mTLS, SSO) even if the backend service does not require it, to prevent unauthenticated access.
   • Audit and rotate all secrets (API keys, tokens, database credentials) stored on the host filesystem of Palantir servers in case an undetected read has already occurred.

2. Patch/Upgrade Steps:

   • Monitor Palantir’s official advisory channels (Palantir Customer Portal, Foundry release notes, support emails) for a fix. Subscribe to CVE-2023-30945 alerts on NVD and CISA.
   • Once a fixed version of the affected services (VHS, VCD, Clips2) or a shared library is released, upgrade immediately. Validate the patch in a staging environment before production rollout.
   • If the vendor provides configuration options to enable strict filename validation or path whitelisting, apply those settings as an interim measure.

3. Long-term Hardening:

   • Isolate Palantir services on dedicated security zones with strict east-west traffic controls (e.g., micro-segmentation).
   • Implement file integrity monitoring (FIM) on Palantir host filesystems to detect unauthorized writes or deletions.
   • Deploy central logging and alerting for HTTP requests containing traversal patterns, using the detection rules above.
   • Conduct a penetration test or security review of all Palantir internal services — the shared vulnerability component may affect other undisclosed services beyond VHS/VCD/Clips2.
   • Review Palantir deployment documentation for file-serving endpoints and enforce upstream validation of all user-supplied filenames at the proxy layer.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-30945 — Official NVD description, CVSS score, and references.
2. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2023-30945 is NOT listed (no KEV entry as of this report).
3. MITRE ATT&CK — T1190: https://attack.mitre.org/techniques/T1190/ — Technique mapping for exploitation of public-facing applications.
4. CWE-22 Path Traversal: https://cwe.mitre.org/data/definitions/22.html — Weakness class reference for the underlying file-path validation flaw.
5. Palantir Official Site (vendor): https://www.palantir.com/ — No known vendor advisory or patch link available; monitor Palantir Foundry release notes.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None known at the time of writing. No public exploit code, Nuclei template, or Metasploit module exists. The EPSS percentile (50.7%) suggests active monitoring by security researchers and possible scanning activity, but no confirmed exploitation has been reported. The vulnerability remains unpatched, which increases the likelihood of an exploit being developed in the near term.