CVE-2023-30950

Executive Summary

CVE-2023-30950 is an unauthenticated information disclosure vulnerability affecting the Palantir Foundry campaigns service. The flaw resides in a REST endpoint that fails to enforce authentication, allowing unauthenticated remote attackers to retrieve sensitive data. With a CVSS score of 6.5 (High severity based on confidentiality impact), the vulnerability is exploitable remotely without credentials, though no public exploit code or active exploitation in the wild has been documented as of this report. Organizations running Palantir Foundry deployments should prioritize patching the campaigns service and auditing access logs for signs of unauthorized enumeration.

Technical Analysis

The vulnerability is described as an "unauthenticated information disclosure in a rest endpoint" within the Foundry campaigns service. This is a classic authentication bypass flaw affecting an API surface — the REST endpoint in question does not enforce authentication prior to returning data. The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), though the CNA did not formally assign a CWE identifier.

Attack Mechanism:

REST endpoints in enterprise platforms such as Palantir Foundry typically handle requests for resources, configuration data, or operational metadata. When authentication middleware is misconfigured or an endpoint is erroneously excluded from the authentication filter chain, unauthenticated requests are processed as if they were authorized. The resource returned may include:

• Internal campaign configuration data
• User or organizational metadata
• Operational status information
• Potentially sensitive business logic details

The NVD description does not specify the exact data exposed, the HTTP method involved, or the URL path. Insufficient technical detail is available to enumerate specific parameters or request formats.

Attack Surface:

The attack surface is the publicly exposed REST endpoint of the Foundry campaigns service. Palantir Foundry is typically deployed in enterprise environments, either on-premises or in Palantir-managed cloud infrastructure. The service may be reachable via:

• Direct internet exposure (misconfigured deployments)
• Internal network access via VPN or private links
• Multi-tenant Foundry environments where tenant isolation is misconfigured

Code-Level Analysis:

No source code, patch diff, or vendor advisory with implementation details is available publicly. Without access to the affected codebase or a vendor-published details document, a precise code-level analysis is not possible. The vulnerability class suggests the absence or misordering of an authentication gate (e.g., middleware, interceptor, or filter) on one or more routes in the campaigns service.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (unauthenticated information disclosure on a REST endpoint).

Step 1 — Reconnaissance/Target Identification:

An attacker identifies Palantir Foundry deployments via Shodan search (e.g., "Palantir Foundry", "foundry campaigns") or by scanning enterprise IP ranges for known Foundry API signatures. The campaigns service may be subdomain-resolvable (e.g., campaigns..foundry.palantir.com) or accessible via dedicated API gateways. Attackers may also discover the service through exposed Swagger/OpenAPI documentation common in enterprise platforms.

Step 2 — Triggering the Flaw:

Once the campaigns service REST endpoint is identified, the attacker sends unauthenticated HTTP requests directly to the endpoint. Since the vulnerability is classified as unauthenticated access to a REST endpoint, the attacker likely does not require session tokens, API keys, or other authentication material. Requests may include GET, POST, or other methods depending on the endpoint's design.

Step 3 — Payload/Execution at Vulnerability-Class Level:

At the class level, the attacker exploits the missing authentication check by simply issuing direct requests. The attack does not require SQL injection, command injection, or other payloads — the flaw is the absence of an access control check. The attacker may:

• Enumerate campaign identifiers to discover data ranges
• Use predictable resource IDs to access multiple records
• Leverage verbose error messages or pagination parameters to dump large datasets

Step 4 — Post-Exploitation Impact:

The information disclosed may feed further attacks:

• Stolen credentials or tokens embedded in campaign data could enable authenticated access
• Internal architecture details could facilitate targeted exploitation of other services
• Organizational metadata could support social engineering campaigns
• If the data is regulatory-sensitive (PII, financial data), the disclosure may trigger breach notification obligations

The disclosure is read-only; it does not directly allow data modification or execution. However, combined with additional Foundry vulnerabilities or exposed credentials, lateral movement may be possible.

Impact Assessment

Business Impact:

The primary impact is confidentiality loss. The CVSS 6.5 base score reflects this with a High confidentiality impact (C:H) and no integrity (I:N) or availability (A:N) impact. The scope is unchanged, meaning the compromised component (campaigns service) does not allow impact on other system components beyond its own data boundary.

Affected Systems:

• Palantir Foundry deployments using the campaigns service
• Self-hosted and Palantir-managed deployments
• Multi-tenant Foundry environments (data may leak across tenant boundaries)

Blast Radius:

The blast radius depends on the sensitivity of data stored in the campaigns service. In large enterprise deployments, this may include:

• Marketing campaign metadata
• Customer segmentation data
• Internal operational metrics
• Potentially PII or regulated data

Given the unauthenticated nature, any attacker with network access to the endpoint can exploit this without prior foothold. The EPSS score of 0.00412 indicates low exploitation likelihood in the wild, but this does not diminish the risk for high-value targets.

Detection Guidance

Sigma Rule

title: Palantir Foundry Campaigns Service Unauthenticated Access
id: 8a4f6c2e-5b3d-4a8e-9c1f-2d7e9a3b5c6d
status: experimental
description: Detects unauthenticated requests to Palantir Foundry campaigns REST endpoints, potentially indicating exploitation of CVE-2023-30950
author: ValtersIT Threat Intelligence
date: 2025/01/15
logsource:
  category: webserver
  product: apache
  definition: 'Requirements: access logs from Palantir Foundry reverse proxy or web server'
detection:
  selection:
    cs-uri-path:
      - '*campaigns*'
    cs-username: '-'
    c-ip:
      - '!127.0.0.1'
      - '!::1'
  filter_healthcheck:
    cs-uri-path: '*healthcheck*'
  condition: selection and not filter_healthcheck
fields:
  - c-ip
  - c-uri
  - cs-uri-query
falsepositives:
  - Legitimate health checks or monitoring that use unauthenticated endpoints
  - Public-facing API endpoints intentionally unauthenticated
level: high

YARA Rule

rule Palantir_Foundry_Campaigns_InfoDisclosure
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detect patterns associated with CVE-2023-30950 unauthenticated information disclosure in Palantir Foundry campaigns service"
        cve = "CVE-2023-30950"
        date = "2025-01-15"
    strings:
        $s1 = "campaigns" ascii wide nocase
        $s2 = "foundry" ascii wide nocase
        $s3 = "unauthorized" ascii wide nocase
        $s4 = "rest endpoint" ascii wide nocase
        $s5 = "internal" ascii wide nocase
        $s6 = "palantir" ascii wide nocase
        $s7 = "api" ascii wide nocase
    condition:
        3 of them and filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"Potential Palantir Foundry Campaigns Service Unauthenticated Access (CVE-2023-30950)"; flow:established,to_server; http.uri; content:"campaigns"; nocase; http.method; content:"GET"; http.method; content:"POST"; http.user_agent; content:"!"; http.server; content:"!"; reference:cve,2023-30950; classtype:attempted-recon; sid:202309501; rev:1; metadata:created_at 2025_01_15, updated_at 2025_01_15;)

Elastic Detection

sequence by source.ip with maxspan=15m
  [network where dns.question.name like "*foundry*" and destination.port == 443]
  [http where
    http.request.method in ("GET", "POST") and
    url.path like "*campaigns*" and
    not user.name in ("service_account*", "healthcheck*")]

Splunk SPL Query

index=weblog sourcetype=access_combined
| where uri_path LIKE "%campaigns%"
| search NOT user="healthcheck" NOT user="monitor*"
| stats count by src_ip, dest_host, uri_path, user, status
| where count > 5
| eval signature="Potential CVE-2023-30950 Exploitation - Unauthenticated Campaigns Service Access"
| table _time, src_ip, dest_host, uri_path, user, status, count, signature

Wazuh OSSEC Rule

<rule id="309501" level="12">
  <decoded>apache-accesslog</decoded>
  <field name="url" type="pcre2">(?i)campaigns</field>
  <field name="user" type="pcre2">^$</field>
  <description>Possible unauthenticated access to Palantir Foundry campaigns endpoint (CVE-2023-30950)</description>
  <group>cve-2023-30950,palantir_foundry,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

The CNA (Palantir) has claimed that a patch exists, but this is not independently confirmed. No specific patch version, advisory link, or changelog entry is publicly available. Organizations should verify with their Palantir account team for the exact patched version.

1. Immediate Mitigations (before patch verification)

• Restrict network access to the campaigns service REST endpoint via firewall rules, security groups, or network ACLs — allow only trusted internal IP ranges
• Place the campaigns service behind an authenticated reverse proxy or API gateway that enforces authentication irrespective of application-level checks
• If feasible, disable the campaigns service entirely if not actively used
• Implement rate limiting on the endpoint to slow down enumeration attempts
• Monitor access logs for anomalous unauthenticated requests to the campaigns endpoint

2. Patch/Upgrade Steps

• Contact Palantir support or account representatives to confirm the patched version of Foundry that addresses CVE-2023-30950
• Review the Palantir Foundry release notes for any mention of the campaigns service security fix
• Schedule the upgrade in a maintenance window, following Palantir's official upgrade procedures for your deployment model (self-hosted vs. managed)
• After patching, verify the authentication control by sending unauthenticated requests to the endpoint and confirming rejection

3. Long-Term Hardening

• Regularly audit all REST endpoints in Foundry deployments for authentication enforcement — use automated API security scanners that identify unauthenticated endpoints
• Implement a security baseline for all Foundry services: authentication middleware must be applied at the platform edge, not per-endpoint
• Establish a process to review Palantir security advisories as they are released — the CNA advisory is the primary source of truth
• Maintain an inventory of all Foundry services and their exposure (external vs. internal) to quickly assess impact of future vulnerabilities
• If Foundry is internet-facing, place it behind an authenticated Web Application Firewall (WAF) with virtual patching rules targeting this vulnerability class

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-30950 (Official CVE record with NVD description)
2. Palantir Advisory (Claimed): Refer to Palantir security advisories at https://www.palantir.com/security-advisories/ (CNA source — patch claimed but no independent confirmation)
3. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2023-30950 is NOT on KEV as of report date — no evidence of in-the-wild exploitation)
4. CWE-200 Reference: https://cwe.mitre.org/data/definitions/200.html (Exposure of Sensitive Information to an Unauthorized Actor — vulnerability class)
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application technique mapped to this CVE)

Threat Actor Activity: No known threat actor campaigns have been associated with CVE-2023-30950. No exploit-in-the-wild evidence has been reported. The EPSS score of 0.00412 (34.1st percentile) suggests low exploitation likelihood, though this CVE may be leveraged by sophisticated actors targeting Palantir Foundry deployments specifically.