Qlik Sense HTTP Tunneling
CVE-2023-48365 is a critical-severity inconsistent interpretation of HTTP requests vulnerability in Qlik Sense from Qlik, with a CVSS 3.1 base score of 9.9 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected Qlik Sense versions: august_2022; august_2023; february_2022, and others listed below. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on January 13, 2025, which means attacks have been observed in the wild, including in ransomware campaigns.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Check which version of Qlik Sense you run against the affected versions below, and install the vendor's latest release.
- CISA's required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Read the advisory on community.qlik.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Qlik | Qlik Sense | august_2022; august_2023; february_2022; february_2023; may_2022; may_2023; november_2021; november_2022 | Not stated |
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.6 | Critical | CNA (mitre.org) |
| CVSS 3.1 | 9.9 | Critical | NVD |
Official description
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Inconsistent Interpretation of HTTP Requests
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
How developers prevent this class of flaw
- Use a web server that employs a strict HTTP parsing procedure, such as Apache.
- Terminate the client session after each request.
More Inconsistent Interpretation of HTTP Requests vulnerabilities (CWE-444)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Deadline for US federal agencies to remediate, set by CISA.
- Record last changed materially (score, affected products, status or references).
References
Third-party and government advisories
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365US Government Resource
Other vulnerabilities in Qlik Sense
- 8.8 High severity
- 6.5 Medium severity
Qlik Sense Path Traversal Exploited
- 9.9 Critical severity
Qlik Sense HTTP Tunneling Exploited
Recent Inconsistent Interpretation of HTTP Requests vulnerabilities
- 7.5 High severity
- 9.8 Critical severity
- 7.2 High severity
- 7.5 High severity
- 9.4 Critical severity
- 9.1 Critical severity
Spotted an error? Tell us.