CVE-2023-41265

What it actually does

CVE-2023-41265 is an HTTP request tunneling flaw in Qlik Sense Enterprise for Windows. A remote authenticated attacker with low privileges can craft a raw HTTP request that causes the Qlik proxy/front-end layer to pass an embedded request to the backend repository service. Because the backend repository application may execute the tunneled request as if it came from a trusted internal path, the attacker can perform privileged repository actions, potentially gaining administrative control over Qlik Sense, accessing sensitive analytics data, changing security rules, creating or modifying users, and disrupting service.

Why it matters to the business

Successful exploitation can turn a low-privileged Qlik Sense account into administrative control of the platform, exposing business intelligence data, dashboards, identity mappings, and configuration secrets. Because this vulnerability is in CISA KEV, has a high EPSS score, is known to be actively exploited, and is associated with ransomware activity, unpatched internet-accessible or broadly reachable Qlik Sense deployments should be treated as urgent. Operational consequences can include data theft, unauthorized access to business reports, service disruption, persistence inside the analytics environment, and use of the Qlik server as a foothold for broader compromise.

How an attack unfolds

An attacker first obtains or uses a low-privileged Qlik Sense account. They connect to the Qlik Sense web endpoint and send a specially crafted raw HTTP request that contains a tunneled request intended for the backend repository service. The proxy layer mishandles the request boundary and forwards the attacker-controlled inner request to the repository application. The repository service then executes the tunneled request in a higher-trust context, allowing the attacker to perform actions they should not be authorized to perform. From there, the attacker may modify security rules, create or elevate accounts, access QRS API functions, retrieve sensitive application metadata, deploy malicious content, or establish persistence. In observed active exploitation and ransomware contexts, this type of access can be used to stage follow-on tooling, steal data, disable services, or support ransomware deployment.

How to fix it

Upgrade Qlik Sense Enterprise for Windows to a fixed release immediately. Fixed versions are August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13. Versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier are affected. If immediate upgrade is not possible, restrict access to Qlik Sense management and user interfaces to trusted networks or VPN, block direct internet exposure, enforce strong MFA through the identity provider where applicable, review and reduce privileged Qlik accounts, and monitor Qlik proxy and repository logs closely. Mitigations should be considered temporary because the flaw is known exploited and ransomware-associated.

How to confirm the fix worked

Confirm the installed Qlik Sense Enterprise for Windows version and patch level from Qlik Management Console, product build information, or installed package inventory. Verify that the deployment is running August 2023 IR, May 2023 Patch 4 or later, February 2023 Patch 8 or later, November 2022 Patch 11 or later, or August 2022 Patch 13 or later. Confirm that external access to Qlik Sense endpoints is limited to intended users and trusted network paths. Review reverse proxy, load balancer, Qlik Proxy, and Qlik Repository logs to ensure no recent requests show tunneled or malformed HTTP behavior targeting repository API paths. After patching, perform a controlled authenticated test or vendor-recommended validation to ensure crafted tunneled requests are rejected and do not reach backend repository endpoints.

Typical attack path

1. Identify a reachable Qlik Sense Enterprise for Windows deployment.
2. Authenticate with any valid low-privileged Qlik Sense account or use previously stolen credentials.
3. Send a crafted raw HTTP request to the Qlik Sense proxy containing an embedded request intended for the backend repository service.
4. Cause the backend repository application to execute the tunneled request outside the attacker’s normal authorization boundary.
5. Use repository API access to enumerate users, apps, streams, security rules, virtual proxies, and configuration.
6. Create or modify privileged users, security rules, service accounts, or application content.
7. Access or exfiltrate sensitive analytics data and configuration information.
8. Optionally deploy persistence, lateral-movement tooling, or ransomware-related payloads.

How to detect it

Look for evidence of crafted or malformed HTTP requests reaching Qlik Sense proxy endpoints and backend repository API paths. Primary log sources include Qlik Sense Proxy logs, Qlik Sense Repository logs, Qlik audit logs, reverse proxy or load balancer logs, web access logs, Windows Event Logs, EDR telemetry, and identity provider sign-in logs. Focus on authenticated users performing unusual QRS API activity, requests containing embedded HTTP methods inside request bodies or headers, abnormal access to /qrs/ paths through public-facing endpoints, unexpected changes to security rules or administrator membership, new or modified virtual proxies, creation of suspicious users, application exports, and large-volume data access. Because this vulnerability is associated with ransomware exploitation, also hunt for post-exploitation artifacts on Windows hosts such as unexpected command shells launched by Qlik services, new scheduled tasks or services, credential access tooling, archive utilities used for staging data, and mass file modification activity. Correlate suspicious Qlik administrative changes with source IPs, user agents, authentication events, and Windows process activity on the Qlik server.

• /qrs/
• X-Qlik-User
• X-Qlik-Xrfkey
• xrfkey=
• GET /qrs/
• POST /qrs/
• PUT /qrs/
• DELETE /qrs/
• Transfer-Encoding: chunked
• GET http://127.0.0.1:4242/qrs/
• POST http://127.0.0.1:4242/qrs/
• 127.0.0.1:4242/qrs
• localhost:4242/qrs
• C:\ProgramData\Qlik\Sense\Log\Proxy\Trace
• C:\ProgramData\Qlik\Sense\Log\Repository\Trace
• C:\ProgramData\Qlik\Sense\Log\Audit
• Qlik Sense Proxy Service
• Qlik Sense Repository Service
• Proxy.exe
• Repository.exe

What your security team should do

• Treat this as critical priority because it is KEV-listed, actively exploited in the wild, has high exploit probability, and is associated with ransomware activity.
• Patch all affected Qlik Sense Enterprise for Windows servers to a fixed release immediately, prioritizing internet-facing systems.
• If patching cannot be completed immediately, restrict Qlik Sense access to trusted networks or VPN and block direct public exposure.
• Hunt for exploitation in Qlik Proxy, Qlik Repository, web server, reverse proxy, identity provider, and Windows event logs going back at least to the vulnerability publication date where retention allows.
• Review all Qlik administrator accounts, security rules, virtual proxies, user directory connectors, extensions, reload tasks, and recently modified applications for unauthorized changes.
• Rotate credentials and secrets associated with Qlik service accounts if compromise is suspected.
• Investigate unusual repository API activity, privilege changes, new privileged users, unexpected app exports, and large data access patterns.
• Monitor for ransomware precursor behavior on Qlik servers, including suspicious process execution, new services, remote access tools, credential dumping, and abnormal file encryption activity.