CVE-2023-30969

Executive Summary

CVE-2023-30969 affects the Palantir Tiles service, which fails to enforce authentication and authorization on its API endpoints. This API-wide flaw exposes all Tiles functionality to unauthenticated network attackers. Palantir is a data analytics and intelligence platform used primarily by government, defense, and large enterprise customers, making this vulnerability particularly sensitive given the data typically processed by the platform. With a CVSS score of 8.2 (High), this vulnerability allows an unauthenticated attacker to access, modify, or delete tile data, potentially leading to severe data confidentiality and integrity loss. No patch has been identified from any tracked source, leaving affected deployments in a state of elevated risk.

Technical Analysis

The Palantir Tiles1 service is an internal component of the Palantir Foundry platform that manages geospatial and map-based tile data. The NVD description states that the service was "found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints." This indicates a systematic flaw in the service's request-handling architecture rather than a localized bug in a single endpoint.

The vulnerability class here is Missing Authentication for Critical Function (CWE-306). The service exposes a RESTful or similar HTTP-based API, and the authentication middleware or interceptor designed to validate requests is either absent, misconfigured, or not applied consistently across all routes. The CNA title explicitly states "missing authentication on API endpoints," confirming that the flaw is broad and affects multiple, if not all, API routes.

The attack surface is the network-accessible API of the Tiles service. Any endpoint that handles tile creation, retrieval, deletion, or administrative functions is exposed. Since the service is part of the Palantir Foundry platform, it likely interfaces with backend databases storing map data, annotations, and potentially analytics outputs. The exact authentication mechanism expected (OAuth, API tokens, session cookies) is not specified in the available data, but the absence of it entirely on some or all endpoints constitutes the vulnerability.

Insufficient technical detail is available regarding the specific API framework or endpoint naming conventions. However, the vulnerability mechanism is clear: an unauthenticated HTTP request to a vulnerable endpoint will be processed without identity verification, leading to unauthorized access to data and functionality.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and NVD description.

1) Reconnaissance / Target Identification: An attacker scans for exposed Palantir Foundry deployments, specifically looking for the Tiles service API. Shodan and other internet-wide scanning tools can identify these instances by fingerprinting HTTP responses, TLS certificates, or default service banners. The attacker may also target internal networks after an initial foothold, scanning for the Tiles service internally.

2) Triggering the Vulnerability: The attacker sends HTTP requests directly to the exposed API endpoints without any authentication token, cookie, or API key. Because the service does not enforce authentication on all endpoints, these requests are processed normally. The attacker may first probe endpoints with benign GET requests to confirm the lack of authentication, then escalate to more dangerous operations.

3) Payload / Execution Method (Vulnerability-Class Level): At the class level, the attacker leverages the absence of authentication by issuing:

• Unauthenticated GET requests to read tile data, map annotations, and potentially sensitive intelligence outputs.
• Unauthenticated POST/PUT requests to create or modify tile data, injecting false geospatial information or overwriting legitimate map layers.
• Unauthenticated DELETE requests to destroy critical tile datasets, causing availability and integrity loss.

Because the underlying API may pass tile data through to backend storage or processing pipelines, the attacker could potentially leverage the interface to perform secondary attacks, such as injecting malicious content that is later rendered for legitimate users.

4) Post-Exploitation Impact: After successful exploitation, the attacker can exfiltrate sensitive geospatial data, corrupt map data used for mission-critical decisions, or deny service by deleting tiles. The data manipulated by the Tiles service may feed directly into Palantir Foundry's analytics workflows, meaning corrupted data could propagate into downstream reports and decision-making processes. Finally, in an internal network scenario, the compromised service could serve as a pivot point for lateral movement if the service account has elevated permissions.

Impact Assessment

• Confidentiality Impact (High): Attackers can read all tile datasets, including potentially classified or sensitive geospatial intelligence.
• Integrity Impact (Low): Data manipulation is possible, but the CVSS vector suggests limited scope for integrity compromise.
• Availability Impact (Low): Deletion of tile data can cause service disruption, but the impact is confined to the Tiles service.
• Attack Vector (Network): The vulnerability is remotely exploitable over the network without any special access.
• Complexity (Low): No special conditions are required; a simple HTTP request suffices.
• Privileges Required (None): No authentication is needed.

Business Impact: Palantir's customers are predominantly defense, intelligence, and enterprise organizations where the confidentiality of data handled by Foundry is paramount. A full read of map tiles and associated metadata could expose troop movements, infrastructure layouts, or commercial geographic intelligence. The lack of a patch, combined with the attack surface, places affected organizations at continuous risk.

Blast Radius: The Tiles service within a Foundry deployment. If the service shares an authentication boundary with other Foundry microservices (unlikely given the described flaw), the blast radius could extend further. However, per the available data, the impact is contained to the Tiles service and its backend stores.

Detection Guidance

Sigma Rule

title: Palantir Tiles API Unauthenticated Access
id: 5f8a4d0c-2e77-4c1a-9b3e-6d2f8a1c4b9e
status: experimental
description: Detects unauthenticated requests to Palantir Tiles API endpoints
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
    cs-uri-extension: '/tiles/'
  filter:
    cs-username: '*'  # Requests with no username are suspicious
  condition: selection and not filter
falsepositives:
  - Internal health-check scripts
level: high
tags:
  - attack.t1190
  - cve.2023.30969

YARA Rule

rule Palantir_Tiles_Unauth_Access
{
    meta:
        author = "valtersit.com"
        description = "Detect potential Palantir Tiles exploitation attempts"
        date = "2024-01-15"
        cve = "CVE-2023-30969"
    strings:
        $s1 = "tiles" ascii nocase
        $s2 = "palantir" ascii nocase
        $s3 = "unauthorized" ascii nocase
        $s4 = "authentication" ascii nocase
    condition:
        any of them and filesize < 10KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-30969 Palantir Tiles Unauthenticated API Access"; flow:to_server,established; http.uri; content:"/tiles/"; nocase; http.method; content:"GET"; content:"POST"; content:"PUT"; content:"DELETE"; reference:cve,2023-30969; classtype:attempted-admin; sid:202306969; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ any where http.request.method in ("GET", "POST", "PUT", "DELETE") and http.request.uri contains "/tiles/" ]
  [ any where http.response.status_code == 200 and not exists (http.request.headers.authorization) ]

Splunk SPL Query

index=web sourcetype=apache
| where LIKE(uri, "%/tiles/%")
| eval has_auth = if(isnull(authorization_header) OR authorization_header=="", "NO", "YES")
| where has_auth=="NO"
| stats count by src_ip, uri, method, _time
| sort - count

Wazuh OSSEC Rule

<rule id="152817" level="12">
  <decoded_as>json</decoded_as>
  <field name="url">\./tiles/\.</field>
  <description>Palantir Tiles API accessed without authentication (CVE-2023-30969)</description>
  <group>palantir_tiles,cve_2023_30969,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor patch, workaround, or fix has been identified from any tracked source. The following mitigations are based on general security best practices and should be evaluated by the affected organization.

1) Immediate Mitigations:

• Network Restriction: Block external access to the Tiles service API. Place it behind a VPN or restrict it to internal network ranges only.
• Reverse Proxy Enforcement: Deploy a reverse proxy (e.g., nginx, HAProxy) in front of the Tiles service that enforces authentication at the proxy layer, since the application layer is not enforcing it.
• Security Group/ACL Review: Audit all firewall rules and cloud security groups permitting access to the service port. Revoke any unnecessary or permissive ingress rules.
• Monitor Access Logs: Implement the detection rules above to monitor for unauthenticated access attempts.

2) Patch / Upgrade Steps:

• Contact Palantir Support: Actively engage with Palantir's security team to obtain an official patch or guidance. Continue checking Palantir's security advisories for updates.
• Isolate Service: If upgrade is not possible, isolate the Tiles service into a dedicated network segment with strict egress/ingress controls.

3) Long-Term Hardening:

• Application-Level Authentication: Ensure all Foundry microservices enforce authentication at the application layer as a defense-in-depth measure.
• API Gateway Integration: Route all API traffic through an authenticated API gateway to prevent similar missing-authentication flaws in other microservices.
• Regular Security Audits: Conduct periodic automated security scans of all Foundry components to identify similar authentication gaps.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-30969
2. Palantir Security Advisories: https://www.palantir.com/security-advisories/ (check for updates)
3. CVE.org Record: https://cve.org/CVERecord?id=CVE-2023-30969

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for this CVE as of the writing of this report. The EPSS score of 0.00372 (29.9% percentile) indicates a low probability of exploitation in the near term based on current data, but the absence of a patch warrants elevated long-term monitoring.