CVE-2023-30948

Executive Summary

CVE-2023-30948 is an authorization bypass vulnerability in Palantir Foundry's Comments functionality, where attachment retrieval operations are not gated by proper authorization checks. An authenticated user with knowledge of a prior discovered attachment UUID could inject that identifier into arbitrary comments to access attachment content without proper permission validation. The vulnerability affects Foundry environments running Foundry Comments prior to version 2.249.0, and a patch has been rolled out to affected environments by Palantir. The CVSS score is 6.5 (Medium severity), with an EPSS score of 0.00536, indicating a low likelihood of active exploitation in the wild as of the assessment date.

Technical Analysis

The vulnerability resides in the authorization architecture of Palantir Foundry's Comments module. Based on the NVD description, the core flaw is that attachment retrieval operations associated with comments lack an independent authorization gate. In a properly designed system, retrieving an attachment should require verification that the requesting user has permissions on the parent object (the comment and its associated resource). In this implementation, the retrieval endpoint apparently relies solely on the possession of an attachment UUID — a globally unique identifier — rather than performing a secondary authorization check against the requesting user's access context.

The attack mechanism leverages the predictability or discoverability of attachment UUIDs. While UUIDs are generally considered cryptographically random, the flaw here is not UUID predictability but rather the absence of authorization verification at the retrieval step. An authenticated user who has previously legitimately accessed an attachment (or obtained its UUID through some other means) can then inject that UUID into arbitrary comments within the Foundry platform. Because the retrieval functionality does not validate whether the requesting user has authorization for the comment to which the attachment is attached, the system returns the attachment content regardless of the user's actual permissions on that target comment.

The technical root cause falls within the class of IDOR/Authorization Bypass Through User-Controlled Key (CWE-639). The vulnerability class implies that the application uses client-supplied identifiers (the attachment UUID) directly to fetch resources without validating the relationship between the authenticated user and the resource owner or parent object. Notably, the NVD description indicates that this affects "retrieval" (read operations) specifically, not the ability to modify or delete attachments. No function names, class names, URL endpoints, or API paths are provided in the NVD description beyond the generic "Foundry Comments" and "attachments to comments" terminology, so further implementation-level detail is unavailable.

The fixed version, Foundry Comments 2.249.0, presumably introduces an authorization check that validates the requesting user's permissions against the comment resource (and its parent object) before serving the attachment content. The patch was proactively rolled out to all affected Foundry environments by Palantir, suggesting the fix is server-side and requires no client-side intervention.

Exploitation Scenarios

Reconnaissance and Target Identification: An authenticated user of a Palantir Foundry environment identifies the Comments feature and the ability to attach files to comments across various projects and datasets. The attacker maps out accessible comments, potentially focusing on high-value project spaces, sensitive data repositories, or discussions related to restricted datasets.

Triggering the Flaw: The attacker first obtains an attachment UUID. This could occur through one of several legitimate pathways: the attacker may have been a participant in a comment that included an attachment, may have accessed a shared resource at some earlier point, or may have obtained the UUID from logs, cached metadata, or another user's shared context. Once the attacker has a valid attachment UUID, they craft a request to the retrieval functionality, targeting a comment in a different context — one for which they do not hold authorization.

Payload/Execution Method: The attack operates at the application-layer API level. The attacker submits a retrieval request, supplying the known attachment UUID as the key parameter. The critical detail is that they attach this UUID to a comment ID that belongs to a resource they are not authorized to access. Because the Comments functionality does not independently verify the relationship between the authenticated user and the target comment's parent resource, the server processes the request and returns the attachment's content (typically a file download or base64-encoded data stream).

Post-Exploitation Impact: The attacker gains access to confidential file content — potentially containing source code, financial data, proprietary algorithms, internal documents, or other sensitive material — without holding appropriate permissions. The attacker can repeat this process for multiple UUIDs discovered over time, enabling systematic data exfiltration of attachments across the Foundry platform. The confidentiality impact is the primary concern; the attacker does not gain code execution, lateral movement, or persistence capabilities through this flaw alone.

Vulnerability-Class Context: No public PoC or exploit code is available for CVE-2023-30948. The attack chain is inferred from the vulnerability class (CWE-639 — Authorization Bypass Through User-Controlled Key) and the NVD description. The essential prerequisite is valid authentication to the Foundry platform — the vulnerability does not enable unauthenticated access.

Impact Assessment

The business impact of CVE-2023-30948 centers on unauthorized data disclosure within Palantir Foundry environments. Foundry is an enterprise data integration and analysis platform used extensively in defense, intelligence, financial services, healthcare, and other highly regulated industries. The platform often hosts mission-critical and classified or commercially sensitive data, making the confidentiality impact of this vulnerability particularly severe in high-security deployments.

The CVSS base score of 6.5 reflects a medium-severity issue, driven primarily by the high confidentiality impact (C:H) but with constraints limiting attack feasibility. The attack requires valid authentication (PR:L), user interaction is likely required to trigger the retrieval (UI:R), and the attack is network-based (AV:N). The complexity is low (AC:L), meaning no special conditions beyond having a valid attachment UUID are required. The integrity and availability impacts are N/A — the attacker can only read content, not modify or destroy it.

The blast radius is limited to the Comments module's attachment storage — specifically, files that have been attached to comments within the Foundry platform. This is narrower than the full dataset stored in Foundry, but depending on organizational usage patterns, comments often contain supporting documents, screenshots, exported reports, and other sensitive content. The attack requires prior knowledge of an attachment UUID, which means the attacker must have some legitimate prior access to the platform (at least one attachment's UUID). This reduces the likelihood of fully blind exploitation but does not prevent opportunistic abuse where an attacker harvests multiple UUIDs over time.

The EPSS score of 0.00536 (42.5th percentile) indicates a relatively low probability of exploitation in the wild. The vulnerability is not listed on CISA's KEV catalog, suggesting no observed active exploitation campaigns have been officially reported. The authorized vendor patch response limits the exposure window.

Detection Guidance

Note: No public PoC or signature-based detection content exists for this vulnerability. The following detection rules are hypothesis-based and should be tuned to the target environment's specific Foundry deployment characteristics.

Sigma Rule

title: Palantir Foundry Comments Attachment Retrieval Anomaly
id: 27d4f8b2-9a3c-4e7b-8f2a-5c9d61e0b4a8
status: experimental
description: Detects unusual patterns in Foundry Comments attachment retrieval, potentially indicating CVE-2023-30948 exploitation (authorization bypass in attachment access)
author: Valters IT Security Research
date: 2024/01/15
logsource:
    category: application
    product: palantir_foundry
    service: comments_api
detection:
    selection_bulk:
        event.action: "attachment.retrieve"
        request.uri|contains: "comments"
        request.method: "GET"
        # High volume of distinct comment targets with repeated attachment IDs
        request.body|contains|all:
            - "attachmentId"
    condition: selection_bulk
    timeframe: 5m
level: high
falsepositives:
    - Legitimate batch operations by administrators
    - Automated data export workflows
    - Users accessing multiple comments they legitimately participate in
tags:
    - attack.t1213
    - cve.2023-30948
    - cwe.639

YARA Rule

rule CVE_2023_30948_Foundry_Comments_Attachment_Suspicious
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects potential CVE-2023-30948 exploitation patterns in Palantir Foundry API request payloads containing attachment UUID manipulation indicators"
        cve = "CVE-2023-30948"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-30948"
    strings:
        $s1 = "attachment" ascii wide nocase
        $s2 = "commentId" ascii wide nocase
        $s3 = "retrieve" ascii wide nocase
        $s4 = "download" ascii wide nocase
        $s5 = { 5B 22 61 74 74 61 63 68 6D 65 6E 74 49 64 22 5D } // ["attachmentId"]
    condition:
        (uint16(0) == 0x5B7B or uint16(0) == 0x7B5B) and
        3 of them and
        #s1 < 100
}

Suricata IDS Rule

alert http any any -> any any (msg:"Potential CVE-2023-30948 Palantir Foundry Comments Attachment Auth Bypass Recon"; flow:established,to_server; content:"GET"; http_method; content:"/comments/"; http_uri; content:"attachment"; http_uri; pcre:"/[?&]attachmentId=[a-f0-9-]{36}/i"; reference:cve,2023-30948; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-30948; classtype:attempted-recon; sid:20233109; rev:1;)

Elastic Detection

sequence by user.id with maxspan=10m
  [any where event.action in ("GET", "POST") and
   url.path like "*comments*" and
   url.path like "*attachment*"]
  [any where event.action in ("GET", "POST") and
   url.path like "*comments*" and
   url.path like "*attachment*" and
   url.path like "*" + extract_previous_attachment_id + "*"]

Splunk SPL Query

index=foundry sourcetype=foundry_comments_api
| where action="attachment.retrieve"
| eval attachment_id=mvindex(split(uri, "attachmentId="), 1)
| stats count as retrieve_count, dc(comment_id) as distinct_comments by user, attachment_id, src_ip
| where distinct_comments > 5
| table _time, user, attachment_id, src_ip, distinct_comments, retrieve_count
| sort - distinct_comments

Wazuh OSSEC Rule

<rule id="109048" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">foundry_comments</field>
    <field name="action">attachment.retrieve</field>
    <regex>(\"commentId\"\s*:\s*\"[^"]+\")</regex>
    <description>CVE-2023-30948: Possible authorization bypass in Foundry Comments attachment retrieval - multiple comment targets with single attachment</description>
    <group>foundry_vulnerability,cve_2023_30948,</group>
    <mitre>
        <id>T1213</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The single authoritative source (CNA, i.e., Palantir) claims a fix exists in Foundry Comments 2.249.0, but this has not been independently confirmed by third-party security researchers or additional advisories. Organizations should verify patch status through their Palantir account management channel.

Immediate Mitigations (before patching):

1. Audit Foundry Comments usage and identify users with any Comment feature access; review their activity logs for abnormal attachment retrieval patterns.
2. Restrict access to the Comments feature at the permission level — limit who can create comments with attachments and who can participate in comment threads on sensitive resources.
3. Monitor authentication and access logs for users accessing comments and attachments across multiple distinct resource contexts in short timeframes.
4. Review existing comment attachments for potential prior exposure if the environment has been operational for an extended period.
5. Consider disabling attachment functionality within Comments temporarily if permissible within operational requirements.

Patch/Upgrade Steps:

1. Contact Palantir support or check the Foundry release notes to confirm that your environment has received the Comments 2.249.0 patch (or a later version).
2. Verify the patch status using Foundry's built-in version reporting or by inspecting the Comments service version via the Admin Console.
3. If the environment is not yet patched, schedule a maintenance window for the patch rollout. Note that Palantir has stated a patch was proactively rolled out to affected environments, so the primary action is verification rather than manual deployment.
4. After patching, test attachment retrieval from a non-authorized context to confirm the authorization check is functioning correctly.

Long-term Hardening:

1. Implement the principle of least privilege for all Foundry users — restrict Comment feature access to only those who require it for their workflow.
2. Enable comprehensive audit logging for all Comments module operations (creation, retrieval, attachment access) and integrate these logs into the enterprise SIEM.
3. Conduct periodic access reviews for the Foundry platform to remove stale or over-provisioned accounts.
4. Evaluate the use of additional access control layers — consider network segmentation or data classification policies that restrict which resources can have comment attachments (e.g., block attachments on classified or highly restricted datasets).
5. Maintain a vulnerability management process that tracks Palantir security advisories and applies patches within defined SLAs.

References

1. NVD Entry — CVE-2023-30948: https://nvd.nist.gov/vuln/detail/CVE-2023-30948
2. Palantir Foundry Security Advisory (referenced via CNA): https://palantir.com/security-advisories/ (confirm specific advisory number for CVE-2023-30948)
3. CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
4. MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the assessment date, CVE-2023-30948 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public evidence indicates active exploitation campaigns, and there are no known threat actor (APT or cybercrime) references to this CVE. The EPSS score (0.00536, 42.5th percentile) suggests low exploitation likelihood. The NVD description indicates the fix was rolled out without requiring user intervention, which may have limited the exposure window.

PoC/Exploit Status: None available publicly. No Nuclei templates, exploit code repositories, or Metasploit modules referenced this CVE at the time of this report. The attack chain described earlier is inferred from the vulnerability class (CWE-639) and the NVD description.