CVE-2023-48365

What it actually does

Qlik Sense Enterprise for Windows versions prior to the fixed patch levels improperly validate HTTP headers at the proxy layer. An attacker can abuse this behavior to tunnel crafted HTTP requests through the externally reachable proxy to the internal Qlik Repository Service, which is normally trusted as a backend administrative component. This can bypass intended authentication and authorization boundaries, allow access to repository APIs, and enable remote code execution through administrative Qlik functionality such as application, extension, reload task, or service configuration abuse. The issue is an incomplete fix for the earlier Qlik Sense HTTP tunneling vulnerability and has critical confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an attacker control over a Qlik Sense server, including access to analytics content, data connections, credentials exposed to Qlik services, and the ability to disrupt reporting operations. Because this vulnerability is listed in CISA KEV, has active exploitation in the wild, and is associated with ransomware activity, exposed systems should be treated as high-priority remediation targets. The CISA KEV remediation deadline is 2025-02-03, but organizations should not wait if the product is internet-facing or accessible from untrusted networks.

How an attack unfolds

An attacker typically starts by identifying a reachable Qlik Sense Enterprise for Windows deployment, especially one exposing the Qlik proxy service to the internet. They send specially crafted HTTP requests containing manipulated Qlik-related headers or routing metadata that cause the proxy to forward or tunnel traffic to backend repository endpoints. Because the backend repository service trusts certain internal request paths and headers, the attacker can interact with privileged Qlik Repository Service APIs without normal user authentication. From there, the attacker may enumerate configuration, create or modify Qlik resources, import malicious content, create reload or execution tasks, abuse extensions or data connections, and ultimately cause commands or attacker-controlled code to run under Qlik service privileges. In observed real-world activity against this vulnerability class, post-exploitation can include credential theft, persistence, lateral movement, data staging, and ransomware deployment.

How to fix it

Upgrade Qlik Sense Enterprise for Windows to a fixed version immediately. Fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17, or any later supported release that includes the fix. Prioritize internet-facing and partner-accessible Qlik Sense deployments. If immediate patching is not possible, restrict access to Qlik Sense proxy and management endpoints using VPN, firewall allowlists, reverse proxy controls, and network segmentation; block direct untrusted access to repository-related endpoints; and monitor for forged internal Qlik headers. Because this issue resulted from an incomplete prior fix, validate that the installed Qlik patch level specifically includes the remediation for QB-21683, not only earlier HTTP tunneling fixes. If package inventory data shows unrelated operating system packages, validate the Qlik Sense application version directly from the Qlik Management Console or installed product metadata rather than relying only on OS package versions.

How to confirm the fix worked

Confirm the installed Qlik Sense Enterprise for Windows release and patch level is at or above one of the fixed versions. Validate from the Qlik Management Console, product About/version information, installed patch records, and file version metadata on Qlik Sense services. Confirm the Qlik proxy is not reachable from untrusted networks unless explicitly required and protected. Perform an authenticated configuration review to ensure repository service endpoints are not directly exposed. Review recent Qlik Proxy and Repository logs for suspicious tunneled requests, forged Qlik internal headers, unusual repository API activity, new or modified apps/extensions/reload tasks, and administrative actions from unexpected IP addresses. After patching, rerun exposure scans and verify that known exploit-style header tunneling requests are rejected or logged as invalid rather than being forwarded to backend repository APIs.

Typical attack path

1. Scan for externally reachable Qlik Sense Enterprise for Windows proxy endpoints.
2. Confirm the target is running an unpatched build prior to the fixed patch levels.
3. Send crafted HTTP requests with manipulated Qlik headers to tunnel traffic through the proxy to backend repository APIs.
4. Use trusted internal request context to access Qlik Repository Service functionality without normal authorization.
5. Enumerate Qlik configuration, users, apps, data connections, and service settings.
6. Create or modify Qlik resources such as apps, extensions, reload tasks, or administrative objects to gain code execution.
7. Run commands or payloads under the Qlik service account context.
8. Establish persistence, collect credentials or data, move laterally, and potentially deploy ransomware.

How to detect it

To determine whether exploitation already occurred, review Qlik Sense application logs and Windows host telemetry for evidence of HTTP tunneling, unauthorized repository API calls, and post-exploitation behavior. Key log sources include Qlik Proxy logs, Qlik Repository logs, Qlik Scheduler logs, Qlik Engine logs, Qlik Management Console audit events, Windows Security logs, PowerShell logs, Sysmon or EDR telemetry, web proxy logs, firewall logs, and DNS logs. Search Qlik Proxy and Repository logs for external client IPs accessing repository-style paths, requests containing internal Qlik headers, failed or unusual authentication patterns followed by successful administrative API calls, and management activity not associated with known administrators. Search for creation or modification of Qlik apps, extensions, reload tasks, data connections, security rules, virtual proxies, and user directory connectors shortly after suspicious HTTP requests. On Windows hosts, look for Qlik service processes spawning command interpreters, scripting engines, archive tools, credential dumping tools, or outbound network utilities. Because this vulnerability is associated with ransomware activity, also investigate rapid file encryption, shadow copy deletion, new scheduled tasks, unusual service creation, abnormal SMB activity, and suspicious outbound connections after Qlik exploitation indicators.

• X-Qlik-User
• X-Qlik-Xrfkey
• X-Qlik-ProxyRestUri
• X-Qlik-ProxySession
• UserDirectory=INTERNAL
• UserId=sa_repository
• /qrs/
• /qrs/about
• /qrs/app/import
• /qrs/extension
• /qrs/reloadtask
• /qrs/dataconnection
• /qrs/systemrule
• /qrs/virtualproxyconfig
• /qrs/userdirectoryconnector
• xrfkey=
• C:\ProgramData\Qlik\Sense\Log\Proxy\Trace
• C:\ProgramData\Qlik\Sense\Log\Repository\Trace
• C:\ProgramData\Qlik\Sense\Log\Scheduler\Trace
• C:\ProgramData\Qlik\Sense\Log\Engine\Trace
• C:\ProgramData\Qlik\Sense\Repository\Extensions
• C:\ProgramData\Qlik\Sense\Apps
• Qlik Sense Repository Service
• Qlik Sense Proxy Service
• Qlik Sense Scheduler Service
• Repository.exe
• Proxy.exe
• Scheduler.exe
• Engine.exe
• cmd.exe /c
• powershell.exe
• powershell -enc
• wscript.exe
• cscript.exe
• certutil.exe
• bitsadmin.exe
• vssadmin delete shadows
• wbadmin delete catalog
• bcdedit /set {default} recoveryenabled no

What your security team should do

• Immediately identify all Qlik Sense Enterprise for Windows deployments, especially internet-facing instances.
• Patch to August 2023 Patch 2 or the corresponding fixed patch for the deployed release train; prefer upgrading to the latest supported release.
• Treat unpatched exposed instances as potentially compromised because the vulnerability is in CISA KEV, actively exploited, and associated with ransomware campaigns.
• Restrict Qlik Sense access to trusted networks and require VPN or zero-trust access controls for administrative and analytics interfaces.
• Hunt across Qlik Proxy, Repository, Scheduler, Engine, and Windows security logs for forged Qlik headers, backend repository API access from external IPs, suspicious resource creation, and child processes spawned by Qlik services.
• Review Qlik users, custom properties, security rules, data connections, extensions, reload tasks, virtual proxies, and service account permissions for unauthorized changes.
• Rotate credentials and secrets accessible to Qlik services if exploitation is suspected, including data source credentials and service account passwords.
• Enable detailed process creation logging and centralized collection of Qlik application logs for at least the prior 90 days where available.
• If suspicious execution or ransomware indicators are found, isolate the server, preserve forensic evidence, and initiate incident response procedures.