CVE-2025-62487

Executive Summary

CVE-2025-62487 is a security advisory affecting Palantir Dossier, a front-end application for data analysis and visualization. The vulnerability involves a regression introduced in May 2025, where uploaded images are not correctly marked with proper security levels. On deployments without CBAC (Capability-Based Access Control), the security picker dialog is absent, resulting in uploaded files being assigned a security level of "CUSTOM" with no markings or datasets. This leads to files being accessible only by default authorization rules, typically the "Everyone" group, potentially exposing sensitive data to unauthorized users. The CVSS score is 3.5 (Low), but the impact could be significant in environments handling classified or sensitive information.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a configuration and code regression issue within Palantir's proprietary Dossier application. No open-source package or supply chain component is directly affected.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential exposure of uploaded images)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. The vulnerability requires authenticated access and only affects file uploads. However, in high-security environments, the exposure of sensitive images could be critical.

Deep Dive & Mechanics

The vulnerability stems from a code change in May 2025 intended to allow file uploads to be shared among different artifacts (e.g., dossiers and presentations). This change inadvertently removed the security marking logic for uploaded images in the Dossier front-end.

Normal Behavior (with CBAC):

• When a user uploads an image, the front-end presents a security picker dialog.
• The user selects appropriate security levels (markings and datasets).
• The file is stored with those security levels, ensuring proper access control.

Vulnerable Behavior (without CBAC):

• No security picker dialog appears.
• The file is assigned a security level of "CUSTOM" with no markings or datasets.
• The only access control applied is from default authorization rules in the Auth Chooser configuration.
• Typically, these default rules add only the "Everyone" group, making the file accessible to all authenticated users.

Root Cause: The regression occurred in the front-end code that handles file uploads. The security marking logic was bypassed when CBAC was not configured, leading to improper privilege management (CWE-269).

Vulnerable vs. Patched Code

Since this is a proprietary application, exact code snippets are not available. However, the conceptual difference is:

Vulnerable Code (May 2025 regression):

// Pseudo-code for file upload handler
function uploadFile(file) {
  // Missing security marking logic
  // File is uploaded with default security level
  uploadToServer(file, { securityLevel: 'CUSTOM', markings: [] });
}

Patched Code (Expected fix):

// Pseudo-code for file upload handler
function uploadFile(file) {
  if (isCBACEnabled()) {
    showSecurityPickerDialog(file);
  } else {
    // Apply default security markings from configuration
    applyDefaultSecurityMarkings(file);
  }
  uploadToServer(file, { securityLevel: file.securityLevel, markings: file.markings });
}

The patch should ensure that even without CBAC, the file uploads are assigned appropriate security markings based on the Auth Chooser configuration or a fallback mechanism.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Palantir Dossier instance without CBAC configured.
• Authenticated user account.

Steps:

1. Log in to the Dossier application.
2. Navigate to a dossier or presentation where image uploads are allowed.
3. Upload an image file (e.g., sensitive_data.png).
4. Observe that no security picker dialog appears.
5. The uploaded image is now accessible to all users in the "Everyone" group.

Impact: An attacker with low privileges can upload sensitive images that become visible to all authenticated users, potentially leaking classified information.

Blue Team

Detection:

• Monitor for file uploads without security picker dialog events.
• Check logs for uploads with security level "CUSTOM" and no markings.
• Review Auth Chooser configuration for default rules that add "Everyone" group.

Mitigation:

• Enable CBAC on all deployments.
• If CBAC cannot be enabled, configure Auth Chooser to add restrictive default rules (e.g., only specific groups).
• Apply the vendor patch when available.

Indicators of Compromise (IOCs)

• File Uploads: Images uploaded with security level "CUSTOM" and empty markings field.
• Log Entries: Upload events without security picker interaction.
• Access Logs: Unusual access to uploaded images by users outside the intended group.

Detection Engineering

YARA Rule

rule Detect_Palantir_Upload_Security_Bypass {
  meta:
    description = "Detects file uploads with missing security markings in Palantir Dossier"
    author = "Valters IT"
    date = "2025-10-02"
    reference = "CVE-2025-62487"
  strings:
    $upload_event = /upload.*securityLevel.*CUSTOM.*markings.*\[\]/ nocase
    $no_picker = /securityPicker.*false/ nocase
  condition:
    any of them
}

Sigma Rule

title: Palantir Dossier File Upload Without Security Markings
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects file uploads in Palantir Dossier that lack proper security markings, indicating CVE-2025-62487 exploitation.
author: Valters IT
date: 2025/10/02
logsource:
  product: palantir
  service: dossier
detection:
  selection:
    EventID: 'FileUpload'
    SecurityLevel: 'CUSTOM'
    Markings: '[]'
  condition: selection
falsepositives:
  - Legitimate uploads in environments without CBAC but with proper Auth Chooser rules
level: medium

Suricata Rule

alert http any any -> any any (msg:"Palantir Dossier File Upload Without Security Markings"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"securityLevel=CUSTOM"; nocase; content:"markings=[]"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Enable CBAC: If possible, enable Capability-Based Access Control on all Palantir deployments.
2. Review Auth Chooser: Ensure default authorization rules do not add the "Everyone" group. Restrict to specific groups.
3. Monitor Uploads: Actively monitor for file uploads with security level "CUSTOM" and no markings.

Long-Term Fix:

• Apply the vendor patch when released. The patch should restore security marking logic for non-CBAC deployments.
• Implement a fallback mechanism that forces a security picker dialog or applies strict default markings.

Workaround:

• If CBAC cannot be enabled, manually configure Auth Chooser to add restrictive groups (e.g., only administrators) as default.

Valters IT