CVE-2023-30962

Executive Summary

CVE-2023-30962 is a stored cross-site scripting (XSS) vulnerability in the Palantir Gotham Cerberus service, a component responsible for handling attachment-related functionality within the Gotham platform. The vulnerability allows an attacker with an authenticated account on a Gotham deployment to inject malicious scripts that persist within the Cerberus attachment handling workflow, subsequently executing in the browsers of other users who interact with the compromised attachments. The issue has been resolved in Cerberus version 100.230704.0-27-g031dd58, and patch confidence is rated 2/4, based on a single source (the CNA) claiming the fix without independent confirmation.

Affected organizations are enterprises running Palantir Gotham deployments with Cerberus versions prior to the fixed release. The vulnerability carries a CVSS score of 6.8, and an EPSS score of 0.00320, placing it in the 24.5th percentile of known exploited CVEs, indicating a low observed exploitation rate in the wild. No public PoC, Nuclei template, or exploit code exists at the time of writing.

Technical Analysis

The vulnerability resides in the Cerberus service of Palantir Gotham, specifically in the handling of attachments. The CNA title, "Stored XSS in cerberus attachments," indicates that the flaw allows an attacker to embed malicious JavaScript into attachment metadata or attachment-related fields that are subsequently rendered to other users without sufficient sanitization or output encoding.

The attack mechanism is consistent with the stored (persistent) XSS vulnerability class (CWE-79). In a stored XSS scenario, the attacker's payload is persisted on the server side — in this case, within the Cerberus attachment store — and is later served to victim users when they access or preview the attachment. The critical distinction from reflected XSS is that the payload does not need to be re-injected by the victim; the malicious content is delivered automatically by the application when the victim views the affected resource.

From a technical perspective, the likely failure mode is a lack of adequate input sanitization on the server side combined with insufficient output encoding on the client side. When an attacker uploads an attachment or modifies attachment metadata (e.g., filename, description, or any user-controlled field), the application stores the raw input without neutralizing HTML, JavaScript, or event-handler attributes. When another user — potentially one with elevated privileges — views the attachment listing, the embedded payload executes in their browser context.

The attack surface is the Cerberus attachment management interface. An attacker must have valid credentials and the ability to upload or modify attachments. This is not an unauthenticated vulnerability; it requires authenticated access to the Gotham platform. However, the impact is amplified because the trust boundary is crossed: the payload executes in the context of other users, including those with higher privilege levels in the platform.

The NVD description does not provide sufficient technical detail to identify the exact code path, function names, or parameter names involved. Therefore, the analysis must remain at the vulnerability-class level. It is known that the issue is resolved in Cerberus version 100.230704.0-27-g031dd58, which suggests that the fix involved hardening the input validation and output encoding in the attachment rendering pipeline.

Exploitation Scenarios

No public PoC or exploit code exists for this vulnerability. The attack chain described below is inferred from the vulnerability class (stored XSS in an attachment-handling service) and the information available in the NVD description.

Step 1: Reconnaissance / Target Identification An attacker with an authenticated account on a Palantir Gotham deployment identifies the Cerberus attachment service as a target. The attacker enumerates the attachment upload and metadata editing capabilities available to their privilege level. They may also survey other users' activity to determine which users are most likely to access the attachments (e.g., analysts, administrators, or data reviewers).

Step 2: Triggering the Flaw The attacker creates or uploads an attachment through the Cerberus service. In the metadata fields associated with the attachment (such as a description field, filename display text, or other user-controlled attribute), the attacker embeds a malicious script, for example:

<script>/* malicious payload */</script>

or an event-handler-based payload such as:

<img src=x onerror="/* malicious code */">

Because the application fails to sanitize this input, the payload is stored unmodified in the Cerberus attachment database.

Step 3: Payload Execution When a victim user — possibly an administrator or another analyst — opens the attachment list, previews the attachment, or downloads the file, the malicious payload is rendered in their browser without proper output encoding. The script executes in the victim's session context on the Gotham domain, granting the attacker the victim's session permissions and access to data visible to that user.

Step 4: Post-Exploitation Impact The attacker can leverage the executed script to:

• Harvest session cookies and perform session hijacking.
• Perform actions on behalf of the victim, such as modifying data, deleting records, or exfiltrating sensitive intelligence.
• Create new accounts with elevated privileges if the victim has administrative rights.
• Move laterally within the Gotham platform by using the compromised session to access other services.

The attack is particularly dangerous in a Gotham environment, which is typically used for intelligence analysis and handling sensitive data. A successful exploit could result in the unauthorized disclosure of classified or sensitive information.

Note: The above scenario describes the general stored XSS attack pattern. Specific payloads, function names, or API endpoints are not available from the provided data, and their invention would be speculative.

Impact Assessment

The CVSS score of 6.8 reflects a medium-severity vulnerability with meaningful business impact. Breaking down the score components (based on the vector string):

• Attack Vector (AV:N): The vulnerability is exploitable over the network. However, authentication is required (PR:L refers to low privileges).
• Attack Complexity (AC:L): No special conditions are required beyond authenticated access.
• Privileges Required (PR:L): The attacker must have an account with at least basic upload or editing privileges in Gotham.
• User Interaction (UI:R): The victim must interact with the malicious attachment (e.g., view, preview, or download it).
• Scope (S:C): The impact extends beyond the Cerberus service; the script executes in the broader Gotham web platform context, potentially affecting other components.
• Confidentiality Impact (C:L), Integrity Impact (I:L), and Availability Impact (A:L): While impact is limited to the victim's session, the potential for data exfiltration and unauthorized actions is significant.

Business Impact:

• Confidentiality: Exposure of sensitive intelligence data accessible to the victim user. In intelligence platforms, this could constitute a data breach of confidential or classified material.
• Integrity: The attacker can modify or delete data on behalf of the victim, corrupting intelligence records.
• Availability: The attacker could lock out users by altering credentials or cause denial-of-service by injecting destructive scripts.
• Compliance: Organizations operating under regulations such as GDPR, HIPAA, or government security directives may face legal and reputational consequences.

Blast Radius: The blast radius is limited to Palantir Gotham deployments using Cerberus versions prior to the fixed release. The vulnerability requires an authenticated account, so the initial attack is not externally exploitable. However, in a large organization, a single low-privilege account could escalate to full administrator access if an admin views the malicious attachment.

Detection Guidance

Sigma Rule

title: Palantir Gotham Cerberus Stored XSS - Suspicious Attachment Metadata
id: 6f3c9a1e-4b72-4f8a-9c3d-2f5e1a8b7c4d
status: experimental
description: Detects suspicious attachment metadata in Palantir Gotham Cerberus service that may indicate stored XSS exploitation (CVE-2023-30962).
author: Valtersit Threat Intel Team
logsource:
    product: palantir
    service: gotham_cerberus
detection:
    selection_upload:
        EventID: 'upload_attachment'
    selection_metadata:
        - 'attachment_metadata|contains':
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '<img'
            - '<svg'
    condition: selection_upload and selection_metadata
level: high
falsepositives:
    - Legitimate HTML-formatted metadata (rare)
    - Internal content with HTML annotations

YARA Rule

rule Palantir_Gotham_Cerberus_Stored_XSS_CVE_2023_30962 {
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects artifacts potentially related to stored XSS in Palantir Gotham Cerberus attachments (CVE-2023-30962)"
        date = "2025-04-10"
        version = "1.0"
    strings:
        $s1 = "<script" ascii nocase
        $s2 = "onerror=" ascii nocase
        $s3 = "onload=" ascii nocase
        $s4 = "javascript:" ascii nocase
        $s5 = "onmouseover=" ascii nocase
        $s6 = "&lt;script" ascii nocase
        $s7 = "&#60;script" ascii nocase
    condition:
        any of ($s*) and (uint16(0) == 0x4D5A or filesize < 10MB)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-30962 - Palantir Gotham Cerberus Stored XSS Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/cerberus"; http_uri; pcre:"/(<script|onerror\s*=|onload\s*=|javascript\s*:)/i"; sid:2023309621; rev:1; classtype:web-application-attack; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2023-30962;)

Elastic Detection

// Detect potential stored XSS payloads in attachment uploads or metadata modifications
sequence by host.id with maxspan=5m
    [ network where event.type == "connection" and destination.port == 443 and 
      process.name : ("java", "tomcat*", "nginx") ]
    [ process where event.type == "start" and 
      process.args : ("*cerberus*", "*gotham*") and
      process.command_line : ("*<script*", "*onerror*", "*javascript:*") ]

Splunk SPL Query

index=main sourcetype=palantir_cerberus OR sourcetype=gotham_logs
| where "attachment_metadata" LIKE "%<script%" OR "attachment_metadata" LIKE "%onerror%" OR "attachment_metadata" LIKE "%javascript:%"
| table _time, user, action, attachment_name, attachment_metadata
| stats count by user, action
| sort - _time

Wazuh OSSEC Rule

<group name="palantir,cerberus,xss,">
    <rule id="100309" level="10">
        <decoded_as>json</decoded_as>
        <field name="service">cerberus|gotham</field>
        <regex>attachment_metadata.*(&lt;script|onerror|javascript:|onload)</regex>
        <description>Potential stored XSS payload in Palantir Gotham Cerberus attachments (CVE-2023-30962)</description>
        <mitre>
            <id>T1559</id>
        </mitre>
        <group>web_application_attack,xss,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The CNA has stated that the vulnerability is resolved in Cerberus version 100.230704.0-27-g031dd58. This patch claim has not been independently verified by third-party sources. Organizations should validate the fix internally after deployment and monitor for any residual issues.

1. Immediate Mitigations (before patching)

• Restrict attachment upload privileges: Limit which users and roles can upload or edit attachment metadata. Implement a least-privilege model for the Cerberus service.
• Enable Content Security Policy (CSP): If the Gotham platform supports CSP headers, configure a strict policy that blocks inline scripts (script-src 'self') and restricts data exfiltration endpoints.
• Educate users: Warn users to treat unexpected attachments or attachments from unknown users with caution, particularly when metadata contains unusual formatting or HTML.
• Monitor attachment-related activity: Implement the detection rules above to flag suspicious attachment metadata patterns.

2. Patch/Upgrade Steps

• Upgrade Cerberus to version 100.230704.0-27-g031dd58 or later. This is the version confirmed by the CNA as containing the fix.
• After upgrading, run a regression test suite covering the following:
  • Upload of attachments with HTML/JavaScript in metadata fields (should be rejected or sanitized).
  • Viewing and previewing attachments by both standard and administrative users.
  • All existing attachment workflows to ensure no regression in functionality.
• Verify that the Cerberus service logs show no exceptions or errors related to the sanitization module after upgrade.

3. Long-Term Hardening

• Input validation: Enforce strict server-side validation for all attachment metadata fields, rejecting HTML, JavaScript, or encoded variants.
• Output encoding: Ensure all user-controlled data is contextually encoded before rendering, following OWASP guidance on XSS prevention.
• Regular security reviews: Since Palantir Gotham is an intelligence platform handling sensitive data, conduct periodic security reviews of all web-facing services.
• Patch verification: Given the 2/4 confidence level, validate the fix independently by attempting a re-exploitation in a staging environment.
• Monitor CISA KEV: While CVE-2023-30962 is not currently in CISA's Known Exploited Vulnerabilities catalog, monitor this list regularly for updates.
• Implement Web Application Firewall (WAF): Deploy a WAF in front of the Gotham platform to provide an additional layer of detection and blocking for XSS payloads.

References

1. NVD Entry: CVE-2023-30962 — National Vulnerability Database
   https://nvd.nist.gov/vuln/detail/CVE-2023-30962

2. Palantir CNA Disclosure / Advisory — Refer to the Palantir security advisory portal for the official disclosure and patch details for Cerberus 100.230704.0-27-g031dd58.
   https://www.palantir.com/security-advisories/

3. OWASP XSS Prevention Cheat Sheet — Industry reference for mitigating and preventing stored XSS vulnerabilities.
   https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

4. MITRE ATT&CK — T1559 Inter-Process Communication — Relevant tactic for the attack chain used in this XSS scenario.
   https://attack.mitre.org/techniques/T1559/

5. CISA Known Exploited Vulnerabilities Catalog — CVE-2023-30962 is currently NOT listed, but should be monitored for updates.
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Disclaimer: This report is based strictly on the CVE data provided. Specific implementation details, function names, and endpoint paths beyond what is stated in the NVD description are not available. The detection rules are provided as operational guidance and should be tested in your environment before deployment.