Qlik Sense HTTP Tunneling Vulnerability (CVE-2023-41265)

What is affected, what to do

An HTTP Request Tunneling vulnerability in Qlik Sense allows a remote attacker to escalate privileges and execute HTTP requests on the backend server. This affects Qlik Sense Enterprise for Windows versions up to and including May 2023 Patch 3, February 2023 Patch 7, November 2022 Patch 10, and August 2022 Patch 12. The vulnerability is actively exploited in ransomware campaigns since December 2023. Immediate patching to August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13 is critical.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Qlik Sense eq august_2022..august_2022
• Qlik Sense eq february_2023..february_2023
• Qlik Sense eq may_2023..may_2023
• Qlik Sense eq november_2022..november_2022

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Check exposure and cut internet access: Inventory every Qlik Sense Enterprise for Windows node, especially internet-facing proxy endpoints (QPS, typically TCP 443/80). Until patching is verified, block external access or restrict it to VPN or an authenticating reverse proxy.
   • Apply the vendor patch: Upgrade to at least August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11 or August 2022 Patch 13. In practice CVE-2023-41265 is usually chained with the path-traversal flaw CVE-2023-41266. The original fix was later bypassed (CVE-2023-48365), so go to the newest release. Look up the exact version in Qlik's vendor advisory.
   • Assume compromise and verify: For exposed systems patched before late 2023, take forensic snapshots before remediating: memory plus the logs under C:\ProgramData\Qlik\Sense\Log\. Then hunt for persistence such as new local admins, installed remote-access tools or scheduled tasks.
   • Rotate credentials: Renew the Qlik service account credentials, data-connection credentials (DB connectors) and Qlik certificates (QRS/QPS). If the service account is a domain account, review its logons on other hosts.
   • Isolate the host: On any sign of code execution, isolate the Qlik server via EDR. Lateral movement from this entry point is documented in ransomware intrusions.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Allow internal Qlik service ports (QRS 4242, QPS API 4243, authentication 4244, Engine 4747) only between Qlik nodes and the central node. Expose only the proxy port to client and internet networks.
   • WAF/reverse proxy: Drop requests with ambiguous framing. That covers duplicate or conflicting Content-Length/Transfer-Encoding headers, Transfer-Encoding combined with Content-Length, and a second request line embedded in the body. Enforce strict HTTP/1.1 parsing. Also block URL-encoded traversal (..%2f, %2e%2e) in paths under /resources/.
   • IPS signatures: Enable vendor signatures for CVE-2023-41265, CVE-2023-41266 and CVE-2023-48365 (Suricata ET, Snort/Talos, NGFW vendor) in blocking mode in front of the Qlik proxy.
   • Endpoint hardening: Use EDR rules or ASR/AppLocker to stop Qlik service processes (Repository.exe, Scheduler.exe, Engine.exe, Proxy.exe) from spawning shells (cmd.exe, powershell.exe) or download utilities (curl.exe, certutil.exe, bitsadmin.exe).
   • Least privilege: Run Qlik services under a dedicated, non-admin service account with interactive logon denied. Restrict the server's outbound traffic to required destinations (egress allowlist).
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / EDR): A Qlik service spawning a shell. KQL: DeviceProcessEvents | where InitiatingProcessFolderPath has @"\Qlik\Sense\" and FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","certutil.exe","curl.exe","rundll32.exe")
   • Proxy and web access logs: Requests with ..%2f or %2e%2e in /resources/ paths. Also flag anomalous requests carrying Transfer-Encoding that return 2xx without an authenticated session. SPL: index=qlik sourcetype=qlik:proxy uri="*/resources/*" (uri="*..%2f*" OR uri="*%2e%2e*")
   • Post-exploitation persistence: Windows EID 4720/4732 (account created or added to Administrators), EID 7045 (new service, e.g. remote-access tools) and EID 4698 (scheduled task) on Qlik hosts.
   • Network telemetry (Zeek/Suricata): Outbound connections from the Qlik server to unfamiliar destinations. This includes file-sharing or rclone-style uploads, downloads of .exe, .zip or .ps1 files, and new RDP or SMB sessions from the Qlik server to other internal hosts.
   • Sigma shape: logsource: process_creation, product: windows with ParentImage|contains: '\Qlik\Sense\' and Image|endswith: ['\cmd.exe','\powershell.exe'], level high.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

Source: pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Qlik Sense Qlik Sense Enterprise on Windows

References & sources

• community.qlik.comt5/Release-Notes/tkb-p/ReleaseNotes
• community.qlik.comVendor advisory: Qlik Sensepwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265government-resource
• pwn.watchpwn.watch: Qlik Sense: 2 exploited vulnerabilities (CVE-2023-41265, CVE-2023-41266)pwn-watch
• NVD (NIST)NVD: CVE-2023-41265pwn-watch
• NVD (NIST)NVD: CVE-2023-41266pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch