CVE-2023-48365:

Unauthenticated remote code execution vulnerability in Qlik Sense Enterprise for Windows prior to August 2023 Patch 2 due to improper HTTP header validation, permitting an attacker to tunnel requests to the backend server and execute arbitrary code.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.9Critical

Published Date:Nov 15, 2023
CISA KEV Date:Jan 13, 2025
Industries Affected:20

Armis Early Warning:

425 Days

Threat Predictions

EPSS Score:62.0
EPSS Percentile:98%

Exploitability

Score:3.1
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:CHANGED

Impact

Score:6.0
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Overview

Qlik Sense Enterprise for Windows exposed a critical remote code execution vector due to improper HTTP header handling, enabling a remote attacker with network access to tunnel crafted HTTP requests to the backend repository server and execute arbitrary code. The issue can be exploited without user interaction and does not require elevated user privileges beyond access to the network path, leading to a severe impact on data confidentiality and integrity. The vulnerability is linked to an incomplete prior fix for a related CVE and has been addressed across multiple patches, with August 2023 Patch 2 representing the primary fix, alongside a set of prior patches. Organizations should treat this as a high-priority remediation, ensuring all affected systems are upgraded to a fixed version and validated post-patch.

Remediation

Upgrade to a fixed version: Apply August 2023 Patch 2 or any of the listed fixed patches (May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, or November 2021 Patch 17) across all Qlik Sense Enterprise for Windows installations.
Verify and validate: Confirm the patch is installed on all instances by checking version/build numbers; restart affected services as required and verify they come up cleanly.
Testing: After patching, perform vulnerability scans and targeted testing to ensure the HTTP header validation issue cannot be exploited (simulate the tunneling scenario if feasible in a safe test environment).
Apply compensating controls: If immediate patching is not possible, implement network-level mitigations such as restricting access to the Qlik Sense backend, enforcing strict HTTP header validation at the edge (e.g., via a web application firewall or reverse proxy), and segmenting the Qlik Sense deployment from untrusted networks.
Monitor and verify: Stay informed with vendor advisories and CVE feeds (e.g., CISA KEV) and re-scan to confirm remediation; monitor for any related advisories about CVE-2023-41265’s incomplete fixes.
Operational hygiene: Ensure backups and recovery procedures are in place prior to patching, and coordinate with IT operations to minimize downtime and validate service health post-deployment.