CVE-2023-41265 Qlik Sense HTTP Tunneling
Remote attackers can tunnel HTTP requests to the backend repository server, enabling privilege escalation and potential code execution in Qlik Sense Enterprise.
- Exploited in the wild
- Since 7 Dec 2023
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41265?
CVE-2023-41265 is a critical server-side request forgery vulnerability in n/a, published on 29 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Weakness: CWE-444
Which versions are affected by CVE-2023-41265?
It affects 1 product.
Products include Qlik Qlik Sense.
How do I fix CVE-2023-41265?
No fix has been published for CVE-2023-41265 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 28 Dec 2023.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-41265 being exploited?
Yes. Attackers have exploited CVE-2023-41265 in the wild since at least 7 Dec 2023, including in ransomware campaigns.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-h5r5-8fxj-m5cm.