CVE-2023-41265
Qlik Sense HTTP Tunneling Vulnerability
Description
CVE-2023-41265 is a critical HTTP Request Tunneling vulnerability in Qlik Sense Enterprise for Windows, assigned a CVSS score of 9.6. The flaw allows a remote attacker with low-level privileges to tunnel crafted HTTP requests through the raw HTTP layer, causing them to be executed by the backend repository server with elevated permissions. This effectively grants an attacker the ability to bypass access controls and perform unauthorized operations on the server. Affected versions include releases prior to May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog and has been linked to ransomware activity, making timely remediation essential.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| qlik | qlik sense | august_2022; february_2023; may_2023; november_2022 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801(Vendor Advisory)
- https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265(US Government Resource)
Weakness Type
CWE-444: Inconsistent Interpretation of HTTP Requests (“HTTP Request Smuggling”)
This vulnerability is classified under CWE-444, which describes weaknesses arising when a server or proxy interprets HTTP requests differently from the intended recipient, allowing attackers to smuggle or tunnel requests that should not be processed.
In this case, Qlik Sense Enterprise fails to consistently validate and sanitize raw HTTP requests before forwarding them to the backend repository application. An attacker can exploit this inconsistency to inject or tunnel additional HTTP requests, which the backend processes as legitimate elevated-privilege operations. This class of vulnerability is particularly dangerous in multi-tier architectures where a front-end component passes traffic to internal services.
Impact Analysis
The impact of CVE-2023-41265 is rated Critical with a CVSS score of 9.6. The attack originates remotely over the network (AV:N), requires low complexity (AC:L), and only needs low-level user privileges (PR:L). No user interaction is required (UI:N), and the scope is changed (S:C), meaning the attacker can affect components beyond the vulnerable application itself.
Confidentiality Impact (High): Attackers can read sensitive data stored or processed by the Qlik Sense repository backend, including configuration data, user information, and analytical assets.
Integrity Impact (High): By tunneling unauthorized requests to the backend, attackers can modify or delete data, alter application configuration, or inject malicious content.
Availability Impact (None): No direct availability impact is described; the vulnerability is focused on unauthorized access and data manipulation rather than denial-of-service.
With an EPSS score of approximately 0.925 (99.7th percentile), exploitation in the wild is highly likely. CISA has confirmed active exploitation and the vulnerability has been associated with ransomware campaigns.
Exploit Maturity
CVE-2023-41265 has confirmed active exploitation in the wild. It is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 28, 2023. The vulnerability has been linked to ransomware operations, indicating that threat actors are actively leveraging it for significant financial and operational damage. The EPSS score of 0.925 places it in the 99.7th percentile of exploitability, reflecting near-certain exploitation probability. The low attack complexity and minimal privilege requirement make it accessible to a broad range of attackers, including automated exploit tooling.
Remediation
- Apply the vendor patch immediately: Update Qlik Sense Enterprise for Windows to one of the fixed versions: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13.
- Follow KEV guidance: Per CISA requirements, apply vendor mitigations or discontinue use of the product if patches cannot be applied by the due date (2023-12-28).
- Review access logs: Inspect HTTP access logs for anomalous tunneled requests or unexpected backend calls, particularly those appearing to originate from low-privilege accounts performing administrative actions.
- Restrict network access: Limit exposure of Qlik Sense Enterprise to trusted networks and enforce firewall rules to reduce the attack surface.
- Monitor for indicators of compromise: Given the ransomware association, conduct threat hunting for signs of lateral movement or data exfiltration following any potential exploitation.
- Consult vendor advisories: Refer to the Qlik Support Advisory and Release Notes for full patch details.
Technical Details
CVE-2023-41265 exploits an HTTP Request Tunneling (also known as HTTP Request Smuggling) weakness rooted in CWE-444. Qlik Sense Enterprise for Windows uses a multi-tier architecture where a front-end component receives and forwards HTTP requests to an internal backend repository application. The vulnerability arises because the front-end component does not consistently validate or sanitize the raw HTTP request content before passing it to the backend.
An attacker with a valid low-privilege account can craft a specially formed HTTP request that embeds an additional “smuggled” request within the raw HTTP payload. The front-end layer processes only the outer request, while the backend interprets and executes the inner, smuggled request with elevated privileges. This allows the attacker to perform backend operations — such as reading sensitive repository data, modifying configurations, or executing administrative commands — that they would not normally be permitted to access.
The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N confirms that exploitation requires no special conditions beyond a low-privilege account, can be performed entirely over the network, and has significant cross-component impact. The changed scope reflects that the attacker can affect the backend repository application, which is a separate security component from the front-end they authenticated against.
Frequently Asked Questions
What is HTTP Request Tunneling and why is it dangerous?
HTTP Request Tunneling (or HTTP Request Smuggling) occurs when a front-end and back-end server interpret the boundaries of an HTTP request differently. An attacker can exploit this discrepancy to inject hidden requests that are processed by the backend, effectively bypassing access controls and firewall rules. It is particularly dangerous because the backend treats tunneled requests as legitimate.
Who is affected by CVE-2023-41265?
All organizations running Qlik Sense Enterprise for Windows on versions prior to August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13 are affected. The vulnerability requires only a low-privilege user account, meaning any authenticated user could be a potential threat actor.
Is CVE-2023-41265 being actively exploited?
Yes. CISA has added CVE-2023-41265 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The vulnerability has also been linked to ransomware campaigns, underscoring the urgency of applying available patches.
How can organizations verify if they have been compromised?
Organizations should review HTTP access logs on their Qlik Sense Enterprise servers for unusual patterns, such as low-privilege accounts triggering high-privilege backend operations. Security teams should also look for indicators associated with ransomware activity, including unexpected file encryption events, unusual network traffic, or new administrative accounts created without authorization.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.