Qlik Sense HTTP Tunneling
CVE-2023-41265 is a critical-severity inconsistent interpretation of HTTP requests vulnerability in qlik_sense from Qlik, with a CVSS 3.1 base score of 9.9 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected qlik_sense versions: may_2023 and earlier; february_2023 and earlier; august_2022 and earlier. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on December 7, 2023, which means attacks have been observed in the wild, including in ransomware campaigns.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of qlik_sense you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- Read the advisory on community.qlik.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Qlik | qlik_sense | may_2023 and earlier; february_2023 and earlier; august_2022 and earlier | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.6 | Critical | CNA (mitre.org) |
| CVSS 3.1 | 9.9 | Critical | NVD |
Official description
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Inconsistent Interpretation of HTTP Requests
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
How developers prevent this class of flaw
- Use a web server that employs a strict HTTP parsing procedure, such as Apache.
- Terminate the client session after each request.
More Inconsistent Interpretation of HTTP Requests vulnerabilities (CWE-444)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Third-party and government advisories
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265US Government Resource
Other vulnerabilities in qlik_sense
- 8.8 High severity
- 9.9 Critical severity
Qlik Sense HTTP Tunneling Exploited
- 6.5 Medium severity
Qlik Sense Path Traversal Exploited
Recent Inconsistent Interpretation of HTTP Requests vulnerabilities
- 9.8 Critical severity
- 7.2 High severity
- 7.5 High severity
- 9.4 Critical severity
- 9.1 Critical severity
- 7.3 High severity
Spotted an error? Tell us.