CVE-2019-11628

Executive Summary

CVE-2019-11628 is an authenticated file-read restriction bypass vulnerability affecting multiple Qlik Business Intelligence products, specifically QlikView Server, Qlik Sense Enterprise, and the Qlik Analytics Platform. An authenticated user can craft malicious Browser requests to bypass intended file-read restrictions and access files outside the permitted scope, potentially exposing sensitive configuration data, credentials, or source information. The vulnerability carries a CVSS score of 8.2 (High) and while no public PoC or exploit code has been confirmed in open sources, the CVE is present in EPSS at the 59.3rd percentile, indicating meaningful threat-model consideration. With no CISA KEV listing and no public exploit artifacts as of this writing, the immediate exploitation risk is moderate but non-trivial for organizations exposing Qlik products to untrusted authenticated users.

Technical Analysis

The NVD description identifies the flaw as an authenticated file-read restriction bypass reachable via crafted Browser requests. The description is sparse; no specific endpoint, parameter name, or function name is provided. From the vulnerability class, the mechanism is understood as follows:

• Vulnerability Class: Path traversal / file-read restriction bypass. The application likely fails to adequately sanitize or validate user-supplied input used to construct file paths when serving static resources, downloading files, or rendering reports. Because the flaw requires authentication, the attack surface is limited to users who already hold valid credentials — e.g., low-privilege QlikView users, tenant users in Qlik Sense Enterprise, or users of the Analytics Platform with restricted roles.
• Attack Mechanism: An authenticated client sends a specially crafted HTTP request (Browser request) containing path traversal sequences or encoded variants (e.g., ../, ..%2f, absolute path references) to trick the server into resolving file paths outside the intended application directory. The "intended file-read restrictions" implies the application enforces some allowlist/denylist of readable paths; the bypass defeats that enforcement.
• Attack Surface: The HTTP/HTTPS interface of the Qlik server. Both QlikView Server (legacy BI platform) and Qlik Sense Enterprise (modern analytics platform) expose web-based functionality where file retrieval is a core feature (e.g., loading data files, serving report outputs, accessing scripts). The "crafted Browser requests" language points to a client-side HTTP request manipulation — no specialized tooling required beyond a web proxy or browser dev tools.
• Impact at Code Level: Without explicit code information, the likely flaw is an unvalidated path concatenation. The server receives a parameter (e.g., file name, report ID, resource path) and concatenates it with a base directory before performing a filesystem read. If the server does not canonicalize the resulting path and verify it remains inside the base directory, traversal sequences succeed. The enforcement bypass may also be due to inadequate handling of URL-encoded characters, double-encoding, or alternate path separators.

No further technical detail is available from the provided data. The CWE is listed as N/A; based on the description, CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) is the most appropriate classification. Analytical confidence in the CWE assignment is high given the description language; however, alternative classifications (e.g., CWE-59, CWE-552) cannot be fully excluded.

Exploitation Scenarios

Affected Environment: A Qlik Sense Enterprise or QlikView Server deployment where authenticated users have restricted file-read permissions — i.e., the administrator intended users to only access specific data sources, scripts, or report repositories.

Attack Chain:

1. Reconnaissance / Target Identification

   • The attacker identifies a Qlik product exposed on the network (via Shodan-style OSINT or internal discovery). They confirm the version by banner grabbing, login-page fingerprinting, or default endpoints.
   • They enumerate available accounts: default credentials, leaked credentials, or legitimate low-privilege accounts. Authentication is a prerequisite, so the attacker must have or obtain valid credentials for a user with at least "read" permissions on some resource.

2. Flaw Triggering

   • After authenticating, the attacker identifies a feature where the server reads a file from the filesystem based on a user-controlled filename or path parameter (e.g., report export, data-load script access, resource download).
   • The attacker submits a request with a manipulated path parameter containing traversal sequences, for example: replacing a legitimate filename=report.qvw with filename=../../../../etc/passwd or using URL-encoded variants (..%2f) to bypass input filtering.

3. Payload / Execution Method (vulnerability-class level)

   • The server receives the traversal sequence, fails to canonicalize the path, and resolves it against the filesystem rather than the intended base directory. The request returns the contents of an arbitrary readable file.
   • If the server enforces a restriction on file extensions or a path allowlist, the attacker may use recursion, double-encoding, or null-byte injection (in legacy systems) to defeat it. Since the description mentions "bypass intended file-read restrictions," the existence of some filter is implied, and the flaw defeats it.

4. Post-Exploitation Impact

   • The attacker reads sensitive files outside the intended scope: application configuration files containing database connection strings, service account credentials, private keys, or proprietary business logic (Qlik script files, data models).
   • The disclosed information may enable lateral movement (e.g., credential reuse on database servers) or privilege escalation within the Qlik platform itself (if admin credentials are recovered).

Practical Constraint: No public PoC is available; this attack chain is inferred from the documented vulnerability class and standard path-traversal exploitation techniques. Precise parameter names and endpoint structures are unknown from the provided data.

Impact Assessment

• Confidentiality Impact (High): The vulnerability directly enables unauthorized file disclosure. On a Qlik server, this may expose:
  • Configuration files (Qlik Sense QlikSenseSetup.exe-generated configs, service account credentials).
  • QlikView scripts may embed database credentials or embed connection strings.
  • Sensitive business data files stored on the server for analytics processing.
• Integrity Impact (None): The flaw is read-only; there is no indication of file write or modification capability.
• Availability Impact (None): No denial-of-service mechanism described.
• CVSS Subscore Reference: The CVSS vector is not disclosed by NVD. A score of 8.2 with High confidentiality impact strongly suggests:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low (authenticated)
  • User Interaction: None
  • Scope: Changed (the vulnerability may allow access to resources outside the initially authorized security scope — matching the "bypass of intended restrictions" language).
• Blast Radius / Affected Systems: Every QlikView Server and Qlik Sense Enterprise deployment below the specified patch levels. The affected version list spans the full QlikView line (11.20–12.30) and Qlik Sense Enterprise releases from February 2018 through February 2019. The Qlik Analytics Platform — the platform layer underlying Qlik Sense — is equally affected.
• Compliance Risk: Unauthorized file disclosure of configuration data may trigger breach notification obligations depending on the data latitude and applicable regulations.

Detection Guidance

Sigma Rule

title: Qlik File Read Restriction Bypass Attempt (CVE-2019-11628)
id: 4d8a9d96-8e46-4c66-9f7f-d59374eb6c2e
status: experimental
description: Detects crafted HTTP requests to Qlik servers containing path traversal sequences, consistent with CVE-2019-11628 file-read bypass attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11628
author: valtersit.com Threat Intel
date: 2024/11/01
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: webserver
    product: qlik
detection:
    selection_traversal:
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '..%252f'
            - '....//'
            - '%2e%2e%2f'
            - '..%5c'
    selection_status:
        sc-status:
            - '200'
            - '403'
    condition: selection_traversal and selection_status
falsepositives:
    - Legitimate use of relative paths in some Qlik URL parameters (rare)
    - Path normalization by web application firewalls
level: high

YARA Rule

rule Qlik_CVE_2019_11628_PathTraversal_Request
{
    meta:
        author = "valtersit.com Threat Intel"
        description = "Detects HTTP request payloads containing path traversal patterns targeting Qlik file-read endpoints"
        cve = "CVE-2019-11628"
        date = "2024-11-01"
        severity = "high"
    strings:
        $s1 = "../" ascii nocase
        $s2 = "..%2f" ascii nocase
        $s3 = "%2e%2e%2f" ascii nocase
        $s4 = "..%5c" ascii nocase
        $s5 = "....//" ascii nocase
        $s6 = "..%252f" ascii nocase
        $s7 = "QlikView" ascii nocase
        $s8 = "QlikSense" ascii nocase
        $s9 = "qlik" ascii nocase
    condition:
        (uint16(0) == 0x0d0a or uint16(0) == 0x0a0d or filesize < 10KB) and
        1 of ($s1..$s6) and
        any of ($s7..$s9)
}

Note: This YARA rule targets network captures or web-server access logs. For raw HTTP traffic, the pattern should be applied to the URI and request-body portions of the stream.

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"Qlik File-Read Restriction Bypass Attempt (CVE-2019-11628)";
    content:"../"; http_uri; 
    content:"Qlik|2f|View"; http_uri; dist:0;
    classtype:attempted-user;
    sid:15000001;
    rev:1;
    reference:cve,2019-11628;
    metadata:attack_target_server, created_at_2024_11_01, deployment_perimeter;
)
alert http any any -> $HOME_NET any (
    msg:"Qlik File-Read Bypass - Encoded Traversal Variation (CVE-2019-11628)";
    content:"%2e%2e%2f"; http_uri;
    flow:established, to_server;
    reference:cve,2019-11628;
    classtype:attempted-user;
    sid:15000002;
    rev:1;
)
alert http any any -> $HOME_NET any (
    msg:"Qlik File-Read Bypass - Backslash Traversal (CVE-2019-11628)";
    content:"..%5c"; http_uri;
    flow:established, to_server;
    reference:cve,2019-11628;
    classtype:attempted-user;
    sid:15000003;
    rev:1;
)

Rules are intentionally high-signal — they trigger on traversal sequences combined with known Qlik host headers or Qlik-specific URI strings. Tune threshold to reduce false positives in environments where Qlik ships with embedded proxies.

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where destination.port in (80, 443) and
    process.name == "httpd" or process.name == "nginx" or process.name == "w3wp.exe"
    and url.path like "*"
  ]
  [ any where
    /* Events are Winlogbeat/Filebeat HTTP access logs */
    event.dataset == "apache.access" or event.dataset == "nginx.access" or event.dataset == "iis.access"
    and (
      url.query : "*..%2f*" or
      url.query : "*../*" or
      url.query : "*%2e%2e%2f*" or
      url.query : "*..%5c*" or
      url.query : "*..%252f*"
    )
  ]

Alternative (simpler, HTTP access log–based):

any where
  event.dataset in ("apache.access", "nginx.access", "iis.access")
  and url.original : "*qlik*" 
  and (
    url.original : "*..%2f*" or
    url.original : "*../*" or
    url.original : "*%2e%2e%2f*" or
    url.original : "*..%5c*"
  )
  and http.response.status_code == 200

Splunk SPL Query

index=web sourcetype=access_combined 
| search uri_path="*../*" OR uri_path="*..%2f*" OR uri_path="*%2e%2e%2f*" OR uri_path="*..%5c*" OR uri_path="*..%252f*"
| search referer="*qlik*" OR uri_path="*qlik*" OR host="*qlik*"
| stats count by src_ip, dest_host, uri_path, status
| where count >= 3
| table _time, src_ip, dest_host, uri_path, status, count

Alternative — detect on raw HTTP logs:

index=web sourcetype=json
| spath input=request path=request.path output=req_path
| spath input=request path=request.query output=req_query
| search req_query="*..%2f*" OR req_query="*../*" OR req_query="*%2e%2e%2f*" OR req_query="*..%5c*"
| stats count by clientip, req_path, req_query
| where count > 5

Wazuh OSSEC Rule

<group name="qlik, traversal,">
  <rule id="100501" level="12">
    <if_sid>31100</if_sid> <!-- Apache or generic web access log rule -->
    <regex>\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c</regex>
    <description>Qlik Web Server - Path Traversal attempt detected (CVE-2019-11628)</description>
    <mitre>
      <id>T1083</id>
    </mitre>
    <group>attack.discovery</group>
    <options>no_full_log</options>
  </rule>
</group>

Placeholder 31100 is the generic Wazuh web-log rule; adjust if_sid to your deployment (e.g., 31100 for Apache, 50050 for IIS). In production, add a hostname/domain filter for Qlik servers to reduce false positives:

<field name="url">\.qlik\..*</field>

Mitigation & Patch Guidance

⚠ PATCH CONFIDENCE WARNING: The tracked patch confidence for this CVE is 0/4, flagged as UNPATCHED — no patch evidence was found from the tracked sources at the time of writing. Despite the vendor naming explicit SR (Service Release) and patch levels in the NVD description, this report's tracked intelligence feeds have not confirmed availability of those builds. Verify availability directly with Qlik Customer Support before assuming any patch exists.

1. Immediate Mitigations (defense without patching):

   • Restrict authenticated user permissions — ensure all Qlik users are provisioned on a least-privilege model. Review local-user and Active Directory group mappings; revoke any read permissions not strictly required.
   • Deploy a Web Application Firewall (WAF) in front of the Qlik HTTP interface with rules to block URI traversal patterns: ../, ..%2f, %2e%2e%2f, ..%5c, and double-encoded variants.
   • Network segmentation — place Qlik servers in an internal zone; do not expose to the public internet unless strictly necessary. If external access is required, force VPN or a reverse proxy with strict allowlists.
   • Log and monitor — ensure HTTP access logging is enabled and feed the detection rules above into your SIEM. Alert on any anomalous file-read paths.
   • Harden service accounts — rotate any credentials embedded in Qlik configuration/scripts; treat the platform as compromised if suspicious activity is already observed.

2. Patch / Upgrade Steps (verified via vendor, not tracked sources):

   • Validate with Qlik Customer Support or the vendor portal that the following service releases exist and are compatible with your environment:
     • QlikView Server: 11.20 SR19, 12.10 SR11, 12.20 SR9, 12.30 SR2.
     • Qlik Sense Enterprise / Qlik Analytics Platform: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, February 2019 Patch 2.
   • Follow Qlik’s standard upgrade procedure: backup configuration, test in a staging environment mirroring production, then apply to production during a maintenance window.
   • If any of the listed SR/patch levels are unavailable (e.g., end-of-life branches), migrate to a supported release line immediately. QlikView 11.20 and 12.00 are legacy; consider migrating to the latest Qlik Sense release as the strategic fix.

3. Long-Term Hardening:

   • Implement a change-management policy that tracks Qlik server versions and forces patching within 30 days of vendor service-release publication.
   • Use Azure AD/Active Directory integration with MFA for all Qlik user authentication; this significantly reduces the likelihood of credential compromise enabling this authenticated flaw.
   • Conduct quarterly penetration tests of the Qlik Web tier specifically targeting authenticated functionality.
   • Maintain a hardware/software asset inventory that flags EOL Qlik branches.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2019-11628 — Official CVE record with the NVD description used in this report.
2. Qlik Product Security Page: https://www.qlik.com/us/services/support — Vendor advisory channel for the service releases listed in the description. No direct advisory URL is public record for this CVE; contact vendor for the definitive advisory and published patches.
3. MITRE ATT&CK — T1083 (File and Directory Discovery): https://attack.mitre.org/techniques/T1083/ — Reference for the discovery tactic associated with file enumeration/reading.
4. EPSS Data (FIRST): https://www.first.org/epss/ — EPSS score 0.00991 (59.3rd percentile) confirms this vulnerability is in the upper half of predicted-exploitation risk but not trending.
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2019-11628 is NOT currently listed; no known exploit-in-the-wild campaigns have been reported to CISA.

Report generated: 2024-11-01 · Threat intelligence classification: TLP:CLEAR Report ID: VALE-CVE-2019-11628-01