CVE-2024-36077

Executive Summary

CVE-2024-36077 is a critical privilege escalation vulnerability in Qlik Sense Enterprise for Windows. The flaw stems from improper validation of user permissions, allowing a remote attacker with a valid low-privileged account to elevate their privileges to the internal system role. This effectively grants the attacker administrative control over the Qlik Sense server, enabling them to execute arbitrary commands, access sensitive data, and potentially pivot to other systems within the network.

The vulnerability affects a wide range of Qlik Sense versions, spanning from May 2022 Patch 17 to February 2024 Patch 3. Qlik has released patches for all affected branches, and immediate upgrading is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary enterprise software vulnerability in Qlik Sense Enterprise for Windows. Therefore, supply chain package security considerations are not directly applicable. However, organizations should ensure that their Qlik Sense installation is obtained from official Qlik sources and that all software dependencies are kept up-to-date.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low (L) - The attacker needs a valid low-privileged user account on the Qlik Sense system.
• User Interaction (UI): None (N) - No user interaction is required for exploitation.
• Scope (S): Unchanged (U) - The vulnerability does not affect components outside of the Qlik Sense server.
• Confidentiality (C): High (H) - Successful exploitation can lead to complete disclosure of all data on the system.
• Integrity (I): High (H) - The attacker can modify or delete any data on the system.
• Availability (A): High (H) - The attacker can cause a denial of service or disrupt the system's operation.

Threat Level: Critical. The combination of low attack complexity, low privileges required, and high impact makes this a highly dangerous vulnerability. An attacker with a simple user account can gain full control of the Qlik Sense server.

Deep Dive & Mechanics

The vulnerability is rooted in improper validation of user roles and permissions within Qlik Sense's authorization framework. Qlik Sense uses a role-based access control (RBAC) system to manage user privileges. The "internal system role" is a highly privileged role that allows users to perform administrative tasks, including executing system commands.

The flaw lies in how the application validates a user's role when processing certain API requests or internal function calls. Due to insufficient checks, an attacker can craft a malicious request that tricks the application into granting them the internal system role, even though they only possess a low-privileged account.

The exact mechanism is not publicly disclosed to prevent widespread exploitation, but it likely involves manipulating session tokens, user context objects, or API parameters that define the user's role. By sending a specially crafted HTTP request to a vulnerable endpoint, the attacker can elevate their privileges without needing to authenticate as an administrator.

Vulnerable vs. Patched Code

Since the exact vulnerable code is proprietary and not publicly available, we can only describe the general nature of the fix.

Vulnerable Code (Conceptual): The vulnerable code likely performs a role check similar to the following pseudo-code:

// Vulnerable: Insufficient validation
function processRequest(user, request) {
    if (user.role == "admin" || user.role == "system") {
        // Execute privileged action
        executeCommand(request.command);
    } else {
        // Deny access
        return "Access Denied";
    }
}

The vulnerability could be that the user.role is derived from an untrusted source (e.g., a request parameter or a token that can be forged) without proper server-side verification.

Patched Code (Conceptual): The patched code would enforce strict server-side validation of the user's role, ensuring it is retrieved from a trusted session store and cannot be manipulated by the client.

// Patched: Server-side role validation
function processRequest(userSession, request) {
    // Retrieve role from trusted session store
    String userRole = getRoleFromSession(userSession);
    if (userRole == "admin" || userRole == "system") {
        // Execute privileged action
        executeCommand(request.command);
    } else {
        // Deny access
        return "Access Denied";
    }
}

The key difference is that the patched code does not trust any client-supplied data to determine the user's role. It relies on a secure, server-side session management system.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid low-privileged user account on a vulnerable Qlik Sense instance.
• Network access to the Qlik Sense server (typically on port 443 or 4244).
• Knowledge of the Qlik Sense API endpoints.

Exploitation Steps (Conceptual):

1. Reconnaissance: Identify the Qlik Sense version by accessing the login page or a specific API endpoint (e.g., /qrs/about).
2. Authentication: Log in with the low-privileged account to obtain a valid session token.
3. Craft Malicious Request: Create an HTTP request to a vulnerable API endpoint (e.g., /qrs/systemcommand or similar) that includes a manipulated session token or user context object that claims the SystemAdmin role.
4. Execute Command: Send the crafted request to execute a system command, such as creating a new admin user or launching a reverse shell.

Example (Conceptual cURL command):

# This is a conceptual example. The actual endpoint and parameters are not publicly known.
curl -k -X POST "https://target.qlik.com/qrs/systemcommand" \
  -H "Authorization: Bearer <MANIPULATED_TOKEN_WITH_SYSTEM_ROLE>" \
  -H "Content-Type: application/json" \
  -d '{"command": "net user attacker P@ssw0rd! /add && net localgroup administrators attacker /add"}'

Note: No public exploit code is available for this CVE. The above is a hypothetical representation of the exploitation process.

Blue Team (Defensive)

Detection and Response:

1. Monitor Authentication Logs: Look for unusual patterns in Qlik Sense authentication logs, such as users accessing administrative endpoints without prior admin privileges.
2. API Request Monitoring: Analyze API requests for anomalies, especially those targeting sensitive endpoints like /qrs/systemcommand or /qrs/servicecluster.
3. Session Token Analysis: Investigate any session tokens that appear to have been tampered with or that claim elevated privileges without a corresponding authentication event.
4. Command Execution Logs: Monitor for unexpected system commands executed on the Qlik Sense server, such as user creation, service manipulation, or file access.
5. Network Segmentation: Ensure the Qlik Sense server is in a segmented network with strict access controls to limit the blast radius of a potential compromise.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual HTTP POST requests to /qrs/systemcommand or similar administrative endpoints from non-admin users.
  • Anomalous session tokens in API requests that contain role claims like SystemAdmin or RootAdmin.
  • Outbound network connections from the Qlik Sense server to unknown IP addresses (potential reverse shell).

• Host IOCs:

  • New user accounts created on the Windows server, especially in the Administrators group.
  • Unusual processes running on the Qlik Sense server (e.g., cmd.exe, powershell.exe, nc.exe).
  • Modified or deleted Qlik Sense configuration files.
  • Suspicious entries in the Windows Event Log (Event ID 4720 - User Account Created, Event ID 4732 - User Added to Security Group).

• File IOCs:

  • Presence of tools like mimikatz, psexec, or custom scripts in the Qlik Sense installation directory.
  • Unauthorized changes to Qlik Sense binaries or configuration files.

Detection Engineering

YARA Rule

rule CVE_2024_36077_Qlik_Sense_PrivEsc {
    meta:
        description = "Detects potential exploitation of CVE-2024-36077 in Qlik Sense logs"
        author = "Valters IT"
        date = "2024-05-28"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-36077"
        severity = "critical"

    strings:
        $s1 = "SystemAdmin" nocase
        $s2 = "systemcommand" nocase
        $s3 = "privilege escalation" nocase
        $s4 = "role elevation" nocase

    condition:
        any of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-36077 - Qlik Sense Privilege Escalation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-36077 by monitoring for suspicious API requests to Qlik Sense administrative endpoints.
author: Valters IT
date: 2024/05/28
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36077
logsource:
    product: qlik
    service: sense
detection:
    selection:
        EventID: 4624  # Logon event (adjust as needed)
        TargetUserName: '*'
        LogonType: 3  # Network logon
    filter:
        TargetUserName|endswith: 'admin'  # Exclude known admin accounts
    condition: selection and not filter
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-36077 Qlik Sense Privilege Escalation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/qrs/systemcommand"; http_uri; nocase; content:"SystemAdmin"; http_client_body; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Qlik Sense Enterprise for Windows to the latest patched version for your branch:

   • May 2024 (14.187.4) or later
   • February 2024 Patch 4 (14.173.8) or later
   • November 2023 Patch 9 (14.159.14) or later
   • August 2023 Patch 14 (14.139.21) or later
   • May 2023 Patch 16 (14.129.23) or later
   • February 2023 Patch 14 (14.113.19) or later
   • November 2022 Patch 14 (14.97.19) or later
   • August 2022 Patch 17 (14.78.25) or later
   • May 2022 Patch 18 (14.67.34) or later

2. Workaround (if patching is not immediately possible):

   • Restrict network access to the Qlik Sense server to only trusted IP addresses.
   • Implement strict web application firewall (WAF) rules to block requests to sensitive API endpoints (e.g., /qrs/systemcommand).
   • Disable or restrict low-privileged user accounts until the patch can be applied.
   • Enable detailed logging and monitoring for all administrative actions.

Long-Term Mitigations:

• Principle of Least Privilege: Regularly audit user roles and permissions within Qlik Sense. Remove any unnecessary privileges.
• Network Segmentation: Place the Qlik Sense server in a dedicated network segment with strict firewall rules.
• Regular Patching: Establish a process for timely application of security patches.
• Security Awareness: Train administrators and users on the risks of privilege escalation vulnerabilities.

Valters IT
Securing Your Digital Frontier