Palantir AtlasDB certificate host validation

Summaryinfo

A vulnerability, which was classified as critical, was found in Palantir AtlasDB. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to certificate host validation. This vulnerability appears as CVE-2022-27890. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Palantir AtlasDB (affected version not known) and classified as problematic. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a certificate host validation vulnerability. The CWE definition for the vulnerability is CWE-297. The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host. As an impact it is known to affect confidentiality. CVE summarizes:

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of AtlasDB, the vulnerability was mitigated by other network controls such as two-way TLS when deployed as part of a Palantir platform. Palantir still recommends upgrading to a non-vulnerable version out of an abundance of caution.

The weakness was presented 02/16/2023. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-27890 since 03/25/2022. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-32378). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Palantir

Name

• AtlasDB

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion