Qlik Sense HTTP Tunneling Vulnerability (CVE-2023-48365)

What is affected, what to do

The CVE-2023-48365 vulnerability in Qlik Sense allows an attacker to perform unauthenticated remote code execution (RCE) via HTTP tunneling, leading to privilege escalation. This enables the attacker to execute HTTP requests on the backend server hosting the repository application. The vulnerability is actively exploited in ransomware campaigns since 2023. All versions of Qlik Sense Enterprise for Windows before August 2023 Patch 2 are affected. Immediate patching to the specified versions is critical to mitigate this risk.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Qlik Sense eq august_2022..august_2022
• Qlik Sense eq august_2023..august_2023
• Qlik Sense eq february_2022..february_2022
• Qlik Sense eq february_2023..february_2023
• Qlik Sense eq may_2022..may_2022
• Qlik Sense eq may_2023..may_2023
• Qlik Sense eq november_2021..november_2021
• Qlik Sense eq november_2022..november_2022

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch now: Upgrade Qlik Sense Enterprise for Windows to a fixed release: August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15 or November 2021 Patch 17. These also close the predecessor flaws CVE-2023-41265 and CVE-2023-41266. Move out-of-support releases to a supported track. Patch every node in multi-node deployments (central and rim).
   • Cut exposure: Until patched, put internet-facing Qlik Sense proxy endpoints (typically 443/TCP, possibly 80/TCP) behind a VPN or zero-trust gateway, or restrict them by firewall to known source ranges.
   • Assume breach if exposed: If the server was internet-reachable and unpatched, treat it as potentially compromised. Review the QMC for new users, role changes (RootAdmin) and unknown tasks. Preserve the logs under C:\ProgramData\Qlik\Sense\Log\ (Repository, Proxy, Scheduler) before they rotate.
   • Host forensics: Run EDR queries for child processes of the Qlik services (Scheduler.exe, Engine.exe, Repository.exe, Proxy.exe). Hunt for newly installed remote-access tools, new local accounts and scheduled tasks on the Qlik host.
   • Rotate credentials: If compromise is suspected, rotate the Qlik service account, the repository database credentials and the secrets stored in data connections (ERP/DWH sources). Review AD sign-ins for the service account.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the Qlik Sense server in its own zone. Restrict the internal service ports (defaults: 4242 QRS, 4243 QPS API, 4244 authentication, 4747 Engine) to traffic between Qlik nodes only, never from client VLANs or the internet. Limit server egress to required data sources and deny direct internet egress, which hinders tool staging and exfiltration.
   • Reverse proxy / WAF: Front the server with a normalising reverse proxy. Drop requests with conflicting or duplicate Content-Length/Transfer-Encoding headers, unusual Connection/Upgrade combinations outside legitimate WebSocket paths, and headers with odd casing or control characters. Deny all external access to /qrs/ paths.
   • IPS: Enable vendor signatures for both CVE-2023-41265 and CVE-2023-48365 (Suricata/Snort or commercial IPS) in blocking mode. Both are needed because this flaw bypasses the original fix.
   • Endpoint hardening: Use ASR or EDR policy to prevent Qlik service processes from spawning cmd.exe, powershell.exe, rundll32.exe or msiexec.exe. Alternatively, enforce AppLocker or WDAC on the server.
   • Least privilege: Run Qlik under a dedicated domain account (ideally a gMSA) with no local admin rights on other systems and no privileged AD group membership.
3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / Windows 4688): A Qlik service spawning a shell or LOLBin is a high-fidelity exploitation signal. KQL: DeviceProcessEvents | where InitiatingProcessFileName in~ ("Scheduler.exe","Engine.exe","Repository.exe","Proxy.exe") and FileName in~ ("cmd.exe","powershell.exe","rundll32.exe","msiexec.exe","curl.exe","certutil.exe")
   • Tooling and persistence: Alert on the following events on the Qlik host: Windows 7045 (new service), 4720 (new local account), 4732 (added to Administrators) and Sysmon EID 11 (executables written to C:\ProgramData or %TEMP%). Watch especially for remote-access tools such as AnyDesk, Splashtop or RMM agents.
   • Proxy and web logs: Search Qlik proxy logs and the upstream reverse proxy for /qrs/ requests from external IPs. Also look for malformed or duplicated headers, and for status sequences that suggest request tunnelling, such as one client producing bursts of 400/500 responses followed by successful QRS calls.
   • Network telemetry (Zeek/Suricata): In Zeek http.log, look for requests to the Qlik server carrying both Content-Length and Transfer-Encoding, or an Upgrade header without a WebSocket handshake. In conn.log, look for new outbound sessions from the Qlik server to cloud storage or unknown hosts with large upload volumes, which may indicate exfiltration (e.g. rclone-style).
   • Repository audit: Hunt the repository audit logs for user creation or role assignment outside change windows. A suitable Sigma shape is a selection on "repository log contains RootAdmin role change" with no matching change ticket.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Qlik Sense Qlik Sense Enterprise on Windows

References & sources

• community.qlik.comQlik advisory: Qlik SenseVendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365government-resource, US government resource
• pwn.watchpwn.watch: Qlik Sense: Sense HTTP Tunneling Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2023-48365pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch