CVE-2023-48365
Qlik Sense HTTP Tunneling Vulnerability
Description
CVE-2023-48365 is a critical unauthenticated remote code execution vulnerability in Qlik Sense Enterprise for Windows. The flaw arises from improper validation of HTTP headers, enabling a remote attacker to elevate privileges by tunneling HTTP requests through the proxy service to the backend repository application. With a CVSS v3.1 score of 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), this vulnerability allows cross-scope access that compromises confidentiality and integrity across adjacent systems. CISA has added it to the KEV catalog with a remediation deadline of February 3, 2025, with confirmed ransomware exploitation. The EPSS score of 0.64226 (98.4th percentile) reflects extremely high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| qlik | qlik sense | august_2022; august_2023; february_2022; february_2023; may_2022; may_2023; november_2021; november_2022 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
Weakness Type
CWE — Unknown
The specific CWE identifiers for CVE-2023-48365 have not been formally disclosed by the vendor. Based on the vulnerability description, the flaw involves improper validation of HTTP headers that allows request tunneling (HTTP request smuggling), which aligns with weaknesses related to improper input validation and HTTP header processing. The attacker exploits the gap between how the proxy service and backend repository application parse HTTP headers, enabling the proxy to forward crafted requests that the backend processes with elevated authority. This type of vulnerability typically maps to weaknesses in HTTP request parsing and trust boundaries between proxy and backend components.
Impact Analysis
Cross-System Compromise Through Request Tunneling defines the threat posed by CVE-2023-48365. By exploiting the HTTP header validation flaw, an attacker bypasses the proxy layer's access controls and executes arbitrary requests against the backend repository application with elevated privileges, ultimately achieving remote code execution.
Confidentiality Impact is maximum (C:H). Successful exploitation provides the attacker with access to the Qlik Sense backend repository, which typically stores business intelligence data, dashboards, data connections, and credentials for data sources. The changed scope (S:C) means the attacker can reach resources beyond the initially compromised component, potentially accessing connected databases, file shares, and data warehouse systems that Qlik Sense integrates with.
Integrity Impact is maximum (I:H). Remote code execution on the Qlik Sense server allows the attacker to modify business intelligence data, alter dashboards and reports, tamper with data source configurations, plant backdoors, and pivot to other systems on the network. Compromised analytics platforms can be used to feed falsified data to decision-makers.
Availability Impact is none (A:N) according to the CVSS scoring, indicating that the vulnerability itself does not directly cause denial of service. However, post-exploitation actions such as ransomware deployment can severely impact availability.
Ransomware Exploitation Confirmed: CISA classifies the ransomware association as "Known." The Cactus ransomware group has been specifically observed exploiting CVE-2023-48365 to gain initial access to corporate networks through internet-exposed Qlik Sense servers. The EPSS score of 0.64226 (98.4th percentile) confirms widespread exploitation activity across the threat landscape.
Exploit Maturity
CVE-2023-48365 is confirmed as actively exploited in the wild with demonstrated use by ransomware groups. CISA's KEV catalog lists it with a remediation deadline of February 3, 2025, and the EPSS score of 0.64226 (98.4th percentile) confirms it is among the most actively targeted vulnerabilities.
Ransomware Campaign Exploitation: CISA classifies the ransomware association as "Known." Security researchers have documented the Cactus ransomware group actively exploiting CVE-2023-48365 to compromise internet-facing Qlik Sense Enterprise servers as an initial access vector. After gaining code execution on the Qlik Sense server, the attackers pivot to the internal network, escalate privileges, and deploy ransomware across the environment.
Exploitation Characteristics: The CVSS vector shows network-based access (AV:N), low complexity (AC:L), and low privilege requirements (PR:L), making exploitation straightforward for attackers with minimal prerequisites. The changed scope (S:C) amplifies the impact beyond the Qlik Sense application itself. The vulnerability can be exploited against any Qlik Sense instance whose proxy service is reachable over the network.
Patch Bypass Context: CVE-2023-48365 is notable as a bypass of an earlier fix. The original vulnerability was addressed in an earlier patch, but the fix was incomplete, allowing attackers to circumvent the remediation through modified HTTP header manipulation. This history demonstrates that partial fixes can create a false sense of security.
Vendor Patches Available: Qlik has released patches through their official support article, providing fixed versions for the August 2023 Patch 2 and May 2023 Patch 12 releases. Organizations running earlier versions must upgrade to these or later releases.
Remediation
-
Apply the Qlik Sense security patches immediately by upgrading to August 2023 Patch 2 or May 2023 Patch 12 or later. Download the patched versions from the Qlik official support article. Verify the patch level after installation through the Qlik Management Console under the About section.
-
Remove Qlik Sense from internet-facing exposure if it has not already been secured. Qlik Sense Enterprise should never be directly accessible from the internet without proper security controls. Place it behind a VPN, reverse proxy with WAF capabilities, or zero-trust network access solution. Restrict access to authorized internal networks and authenticated remote users only.
-
Audit the Qlik Sense server for indicators of compromise before and after patching. Check for unauthorized user accounts, unexpected scheduled tasks, new or modified extensions, suspicious data connections, unknown processes running on the server, and evidence of lateral movement to connected systems. Review Windows event logs and Qlik Sense audit logs for anomalous activity during the vulnerable period.
-
Rotate all credentials accessible through Qlik Sense after patching. This includes data source connection strings and credentials, service account passwords, API keys and tokens stored in data connections, LDAP/AD integration credentials, and any other secrets that the Qlik Sense server could access. Assume that all credentials stored in or accessible through the compromised application may have been exfiltrated.
-
Implement network segmentation around the Qlik Sense infrastructure to limit blast radius in case of future compromise. Place Qlik Sense servers in a dedicated network segment with strict firewall rules limiting outbound connections. Monitor all network traffic to and from Qlik Sense servers for anomalous patterns, particularly connections to unexpected external IP addresses.
Technical Details
CVE-2023-48365 is an unauthenticated remote code execution vulnerability in Qlik Sense Enterprise for Windows caused by improper validation of HTTP headers in the proxy service. The vulnerability is tracked as QB-21683 by Qlik.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N produces a base score of 9.6. Network-accessible (AV:N) exploitation with low complexity (AC:L) and low privilege requirements (PR:L) makes it straightforward to attack. No user interaction (UI:N) is needed. The changed scope (S:C) is particularly significant — it means successful exploitation impacts resources beyond the vulnerable component's security authority, enabling the attacker to reach backend systems and connected data sources. Confidentiality (C:H) and integrity (I:H) are maximum, while availability (A:N) is unaffected by the vulnerability itself.
Attack Mechanism: Qlik Sense Enterprise uses a multi-tier architecture where a proxy service handles incoming client requests and forwards them to backend services including the repository application. CVE-2023-48365 exploits a flaw in how the proxy service validates HTTP headers. By crafting specific HTTP headers, an attacker can tunnel arbitrary HTTP requests through the proxy to the backend repository application, bypassing the proxy's authentication and authorization checks. The backend processes these tunneled requests with elevated privileges, treating them as legitimate internal requests.
Exploitation Chain: The attacker sends crafted HTTP requests with manipulated headers to the Qlik Sense proxy service. The proxy fails to properly validate these headers, allowing the attacker's requests to be tunneled to the backend repository application. The backend processes these requests with elevated authority, enabling the attacker to execute arbitrary operations. This can be chained to achieve remote code execution on the underlying Windows server.
Affected Versions: Qlik Sense Enterprise for Windows versions including August 2022, November 2022, February 2023, May 2023, August 2023 (before Patch 2), and earlier releases are affected. The fix was delivered in August 2023 Patch 2 and May 2023 Patch 12.
Patch Bypass History: This vulnerability represents a bypass of an earlier security fix. The initial remediation addressed the core HTTP header validation issue, but the patch was incomplete, leaving a variant exploitation path that CVE-2023-48365 documents. This underscores the importance of thorough security testing of patches, particularly for parsing and validation logic in proxy architectures.
Frequently Asked Questions
What is CVE-2023-48365?
CVE-2023-48365 is a critical remote code execution vulnerability in Qlik Sense Enterprise for Windows with a CVSS score of 9.6. It allows an attacker to exploit improper HTTP header validation in the proxy service to tunnel requests to the backend repository application, ultimately achieving code execution on the server. It is actively exploited by ransomware groups.
Has CVE-2023-48365 been used in ransomware attacks?
Yes. CISA confirms the ransomware association as "Known." The Cactus ransomware group has been specifically observed using this vulnerability to gain initial access to corporate networks by targeting internet-facing Qlik Sense Enterprise servers, then pivoting internally to deploy ransomware.
Is CVE-2023-48365 related to a previous Qlik Sense vulnerability?
Yes. CVE-2023-48365 is a bypass of a previous security fix for a similar HTTP header validation vulnerability. The original patch was incomplete, allowing attackers to circumvent the remediation with modified header manipulation techniques. This makes it essential to apply the latest patches rather than relying on earlier fixes.
What versions of Qlik Sense are affected?
All Qlik Sense Enterprise for Windows versions before August 2023 Patch 2 and May 2023 Patch 12 are affected. This includes August 2022, November 2022, February 2023, May 2023, August 2023 (pre-Patch 2), and earlier releases. Upgrade to the latest available release to ensure full protection.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.