Vulnerability-Lookup

CVE-2025-53709 (GCVE-0-2025-53709)

Vulnerability from cvelistv5 – Published: 2025-07-10 18:38 – Updated: 2025-07-10 19:00

Title

Access control issues impacting secure-upload service

Summary

Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments. Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests. Authenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control. An endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments. Finally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments. The affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

CWE-285 - The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Assigner

Palantir

References

URL

Tags

https://cwe.mitre.org/data/definitions/285.html

Impacted products

	Vendor	Product	Version
	Palantir	com.palantir.secupload:secure-upload	Affected: * , < 0.815.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-10T19:00:09.941437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-10T19:00:21.291Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "com.palantir.secupload:secure-upload",
          "vendor": "Palantir",
          "versions": [
            {
              "lessThan": "0.815.0",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.\n\nUnder specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests.\nAuthenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control.\nAn endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments.\nFinally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.\n\nThe affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-10T18:38:31.861Z",
        "orgId": "bbcbe11d-db20-4bc2-8a6e-c79f87041fd4",
        "shortName": "Palantir"
      },
      "references": [
        {
          "url": "https://cwe.mitre.org/data/definitions/285.html"
        }
      ],
      "source": {
        "defect": [],
        "discovery": "INTERNAL"
      },
      "title": "Access control issues impacting secure-upload service"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bbcbe11d-db20-4bc2-8a6e-c79f87041fd4",
    "assignerShortName": "Palantir",
    "cveId": "CVE-2025-53709",
    "datePublished": "2025-07-10T18:38:31.861Z",
    "dateReserved": "2025-07-08T20:11:55.448Z",
    "dateUpdated": "2025-07-10T19:00:21.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-53709\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-10T19:00:09.941437Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-10T19:00:17.099Z\"}}], \"cna\": {\"title\": \"Access control issues impacting secure-upload service\", \"source\": {\"defect\": [], \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"capecId\": \"CAPEC-180\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker exploits a weakness in the configuration of access controls and is able to bypass the intended protection that these measures guard against and thereby obtain unauthorized access to the system or network. Sensitive functionality should always be protected with access controls. However configuring all but the most trivial access control systems can be very complicated and there are many opportunities for mistakes. If an attacker can learn of incorrectly configured access security settings, they may be able to exploit this in an attack.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"Palantir\", \"product\": \"com.palantir.secupload:secure-upload\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\", \"lessThan\": \"0.815.0\", \"versionType\": \"semver\"}]}], \"references\": [{\"url\": \"https://cwe.mitre.org/data/definitions/285.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.\\n\\nUnder specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests.\\nAuthenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control.\\nAn endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments.\\nFinally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.\\n\\nThe affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.\"}]}], \"providerMetadata\": {\"orgId\": \"bbcbe11d-db20-4bc2-8a6e-c79f87041fd4\", \"shortName\": \"Palantir\", \"dateUpdated\": \"2025-07-10T18:38:31.861Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-53709\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-10T19:00:21.291Z\", \"dateReserved\": \"2025-07-08T20:11:55.448Z\", \"assignerOrgId\": \"bbcbe11d-db20-4bc2-8a6e-c79f87041fd4\", \"datePublished\": \"2025-07-10T18:38:31.861Z\", \"assignerShortName\": \"Palantir\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-53709

Vulnerability from fkie_nvd - Published: 2025-07-10 19:15 - Updated: 2025-07-15 13:14

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	cve-coordination@palantir.com	https://cwe.mitre.org/data/definitions/285.html

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.\n\nUnder specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests.\nAuthenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control.\nAn endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments.\nFinally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.\n\nThe affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances."
    },
    {
      "lang": "es",
      "value": "Secure-upload es un servicio de env\u00edo de datos que valida tokens de un solo uso al aceptar env\u00edos a canales. El servicio solo se instal\u00f3 en un n\u00famero reducido de entornos. En circunstancias espec\u00edficas, usuarios privilegiados de secure-upload podr\u00edan haber seleccionado plantillas de correo electr\u00f3nico no necesariamente creadas para su inscripci\u00f3n al enviar solicitudes de carga de datos. Usuarios autenticados y privilegiados de una inscripci\u00f3n podr\u00edan haber utilizado incorrectamente un endpoint para redirigir los canales de env\u00edo existentes a un conjunto de datos que controlan. Un endpoint que gestionaba la validaci\u00f3n del dominio permit\u00eda a usuarios no autenticados enumerar las inscripciones existentes. Finalmente, otros endpoints permit\u00edan enumerar si un recurso con un RID conocido exist\u00eda en las inscripciones. El servicio afectado se ha actualizado con la versi\u00f3n 0.815.0 y se ha implementado autom\u00e1ticamente en todas las instancias de Foundry administradas por Apollo."
    }
  ],
  "id": "CVE-2025-53709",
  "lastModified": "2025-07-15T13:14:49.980",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "cve-coordination@palantir.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-10T19:15:27.220",
  "references": [
    {
      "source": "cve-coordination@palantir.com",
      "url": "https://cwe.mitre.org/data/definitions/285.html"
    }
  ],
  "sourceIdentifier": "cve-coordination@palantir.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "cve-coordination@palantir.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JQRW-5FQ8-4HX8

Vulnerability from github – Published: 2025-07-10 21:31 – Updated: 2025-07-10 21:31

Details

Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.

Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests. Authenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control. An endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments. Finally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.

The affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances.

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-53709"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-10T19:15:27Z",
    "severity": "MODERATE"
  },
  "details": "Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.\n\nUnder specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests.\nAuthenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control.\nAn endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments.\nFinally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.\n\nThe affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances.",
  "id": "GHSA-jqrw-5fq8-4hx8",
  "modified": "2025-07-10T21:31:53Z",
  "published": "2025-07-10T21:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53709"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/285.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-53709 (GCVE-0-2025-53709)

FKIE_CVE-2025-53709

GHSA-JQRW-5FQ8-4HX8

Tags

Sightings

Nomenclature