CVE-2024-55580

Executive Summary

CVE-2024-55580 is a high-severity remote command execution vulnerability affecting Qlik Sense Enterprise for Windows prior to the November 2024 IR release. An unprivileged user with network access can exploit this flaw to execute arbitrary remote commands, potentially resulting in complete compromise of the target system. Given Qlik Sense Enterprise is a business intelligence and analytics platform, successful exploitation poses significant confidentiality, integrity, and availability risks to organizations using it for sensitive data processing. The vulnerability is rated 7.5 on the CVSS scale, and multiple patch versions are listed across the November 2023 to November 2024 release trains.

Technical Analysis

The NVD description provides limited implementation detail but establishes a clear vulnerability class: unauthenticated or low-privileged remote command execution on the Qlik Sense Enterprise for Windows platform. The following technical aspects can be derived:

1. Attack Vector: The vulnerability is network-exploitable, meaning the attacker does not require physical or local access to the affected server. It specifically requires network access, suggesting the vulnerable service listens on a network-facing port.

2. Pre-Authentication Nature: The description states "unprivileged users with network access" may exploit this issue. This phrasing is critical: it implies the attacker either requires no valid credentials or can exploit the flaw from a low-privilege state without prior domain/application authentication. This positions the flaw in the "pre-auth RCE" class, which is substantially more dangerous than post-authentication issues.

3. Impact Scope: The vulnerability is described as capable of causing "high availability damages, including high integrity and confidentiality risks." This maps closely to the confidentiality, integrity, and availability (CIA) triad components in CVSS scoring, with the description suggesting the attacker can:

   • Modify or destroy data (integrity impact)
   • Access sensitive information (confidentiality impact)
   • Render services unavailable (availability impact)

4. Fix Distribution: The patch was released across multiple version trains: November 2024 IR (the primary fix), May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. This multi-train patching pattern is consistent with the vendor supporting multiple long-term maintenance branches simultaneously.

Based on the vulnerability class and the pattern of similar Qlik Sense vulnerabilities (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365 in the same product family, which involved path traversal and HTTP request smuggling leading to RCE), this flaw is likely exploited through a web-facing component of the Qlik Sense architecture. However, insufficient technical detail is available from the provided data to identify specific function names, endpoints, or code paths. The attack mechanism can only be described at the vulnerability-class level.

Exploitation Scenarios

Note: No public PoC is available for CVE-2024-55580 at the time of writing. The attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance and Target Identification
An attacker begins by scanning for internet-exposed Qlik Sense Enterprise for Windows instances. Qlik Sense typically operates on specific TCP ports (4443, 443, 80) and presents distinctive HTTP response headers or login pages. Passive reconnaissance via Shodan or Censys would reveal instances running unpatched versions (pre-February 2023 Patch 15 or any version before the specified patch levels). Version fingerprinting can be performed via the login page, API responses, or document metadata.

Step 2 — Vulnerability Trigger
Once a target is identified, the attacker crafts a malicious HTTP request targeting a vulnerable component of the Qlik Sense web application. Given the class of the vulnerability (pre-auth RCE), the request likely exploits a flaw in how the application handles certain input/data, potentially involving path traversal, serialization, or command injection mechanisms. The precise technical trigger is undisclosed in the available data; however, based on the vulnerability class, the request would be designed to cause the server to execute attacker-controlled commands (e.g., via a command interpreter such as cmd.exe on Windows).

Step 3 — Payload Execution
At the vulnerability-class level, the attacker delivers a payload that achieves command execution on the underlying Windows operating system. This payload commonly involves system commands such as certificate retrieval, user creation, or reverse shell initiation. Because the attacker is unprivileged at the application layer but achieves remote command execution, the execution context depends on the privileges of the vulnerable service account — typically a service account that often runs with elevated Windows privileges in Qlik Sense deployments.

Step 4 — Post-Exploitation Impact
After successful execution, the attacker establishes persistence through various Windows mechanisms (scheduled tasks, services, or registry modifications), pivots within the internal network, and exfiltrates sensitive data from the Qlik Sense analytics platform — which commonly stores business-critical dashboards, KPI data, and potentially PII. The dual high-integrity and confidentiality impact described suggests tampering with analytics data is also possible, undermining the integrity of business reporting.

Impact Assessment

Business Impact: Qlik Sense Enterprise is a business intelligence and analytics platform used for data visualization, reporting, and decision support. Compromise of this system exposes:

• Proprietary business data and analytics
• Internal performance metrics and operational KPIs
• Potentially regulated data (PII, financial records) depending on deployment
• Trust in the organization's data integrity and reporting accuracy

Technical Impact:

• Confidentiality Impact: HIGH — Attackers can access all data processed and stored by Qlik Sense, including dashboards, data models, and possibly connected data sources
• Integrity Impact: HIGH — Attackers can modify analytics data, reports, or the application itself
• Availability Impact: HIGH — Attackers can disable the platform, causing significant business disruption

Blast Radius: Any organization running Qlik Sense Enterprise for Windows on versions before the specified patches. This includes on-premises deployments across enterprise environments. The vulnerability affects all deployments that have not applied one of the seven listed patch versions. Given the pre-auth nature, the attack surface is every network-reachable Qlik Sense instance.

CVSS Context: With a CVSS score of 7.5, this is rated High severity. While the score does not reach critical (9.0+), the practical risk may be higher given the pre-auth RCE nature and the platform's common use for sensitive analytics data.

Detection Guidance

Sigma Rule

title: Qlik Sense CVE-2024-55580 - Remote Command Execution Attempt
id: 3f2b52ad-191b-4f1a-aef2-839c9e9a1d3e
status: experimental
description: Detects potential exploitation of CVE-2024-55580 in Qlik Sense Enterprise for Windows, characterized by unusual HTTP requests to Qlik Sense web components followed by process execution anomalies.
author: Valtersit Threat Intelligence
date: 2024-12-01
logsource:
    category: webserver
    product: iis
detection:
    selection_qlik_path:
        cs-uri-stem:
            - '/QvAjaxZfc/'
            - '/QvAjax*
            - '/QvBrowser*
    selection_http_status:
        sc-status: 200
    selection_process_execution:
        # Correlated via Windows Event 4688
        CommandLine|contains:
            - 'cmd.exe /c'
            - 'powershell -enc'
            - 'certutil -urlcache'
    condition: selection_qlik_path and selection_http_status
level: high
falsepositives:
    - Legitimate Qlik Sense administrative activity
tags:
    - attack.t1190
    - cve.2024-55580

YARA Rule

rule Qlik_Sense_CVE_2024_55580_RCE
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects YARA signatures of CVE-2024-55580 exploitation attempts against Qlik Sense Enterprise"
        cve = "CVE-2024-55580"
        date = "2024-12-01"
        severity = "high"

    strings:
        $s1 = "QvAjaxZfc" ascii wide
        $s2 = "QvBrowser" ascii wide
        $s3 = "cmd.exe" ascii wide
        $s4 = "powershell" ascii wide
        $s5 = "QvSense" ascii wide
        $s6 = "post" ascii wide nocase
        $s7 = "session" ascii wide noload

    condition:
        (uint16(0) == 0x4D5A or filesize < 10MB) and
        2 of ($s1, $s2, $s3, $s4, $s5) and
        ($s3 or $s4)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Qlik Sense CVE-2024-55580 RCE Attempt";
    flow:to_server,established;
    http.uri; content:"/QvAjaxZfc"; nocase;
    http.method; content:"POST"; nocase;
    http.request_body; content:"cmd.exe"; nocase;
    http.request_body; content:"powershell"; nocase;
    classtype:web-application-attack;
    sid:202455580; rev:1;
    reference:cve,2024-55580;
)

Elastic Detection

sequence by host.name with maxspan=5s
  [network where event.action == "connection_attempted" and
   destination.port in (443, 4443) and
   process.name == "w3wp.exe"]
  [process where event.action == "start" and
   process.name in ("cmd.exe", "powershell.exe", "certutil.exe") and
   process.command_line : ("*enc*", "*downloadstring*", "*certutil*")]

Splunk SPL Query

index=windows OR index=iis
| search (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="WinEventLog:Security")
| search (CommandLine="*cmd.exe /c*" OR CommandLine="*powershell*enc*" OR CommandLine="*certutil*")
| search (ParentImage="*w3wp.exe" OR ParentImage="*Qv*") OR (cs_uri_stem="/QvAjaxZfc*" OR cs_uri_stem="/QvBrowser*")
| table _time, host, user, CommandLine, ParentImage, cs_uri_stem, src_ip
| sort - _time

Wazuh OSSEC Rule

<group name="qliksense,rce,">
  <rule id="109200" level="15">
    <decoded>alert</decoded>
    <match>QvAjaxZfc|QvBrowser</match>
    <regex>cmd\.exe|powershell|request</regex>
    <description>Possible Qlik Sense CVE-2024-55580 RCE exploitation attempt</description>
    <group>attack.t1190,attack.execution,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="109201" level="12">
    <if_sid>109200</if_sid>
    <match>success|200</match>
    <description>Qlik Sense RCE attempt appears successful</description>
  </rule>
</group>

Mitigation & Patch Guidance

⚠ PATCH DISCREPANCY NOTICE: The internal patch confidence metric reports 0/4 (UNPATCHED — no patch evidence from tracked sources). However, the NVD description explicitly states the vulnerability is fixed in multiple November 2024 IR and 2023–2024 patch releases. This discrepancy may indicate (a) the tracking system has not yet ingested the vendor patch data, or (b) the vendor has not formally published an advisory that this system can verify. Organizations should treat this as ACTIVE/PATCHABLE based on the NVD description.

Immediate Mitigations (apply where patch deployment is delayed):

1. Restrict network access to Qlik Sense Enterprise web consoles and APIs — limit to trusted IP ranges via firewall ACLs or VPN requirements
2. Enforce multi-factor authentication for all Qlik Sense user accounts to reduce unprivileged account compromise
3. Disable or restrict Qlik Sense web components that are not required for business operations
4. Monitor logs aggressively for the detection patterns defined in the Detection Guidance section above
5. Review existing user accounts — remove dormant or unnecessary accounts that could provide attacker footholds

Patch/Upgrade Steps:

1. Apply November 2024 IR for current mainline deployments
2. For organizations on older branches, apply the appropriate patch:
   • May 2024 Patch 10
   • February 2024 Patch 14
   • November 2023 Patch 16
   • August 2023 Patch 16
   • May 2023 Patch 18
   • February 2023 Patch 15
3. Test the patch in a staging environment before production deployment
4. Contact Qlik support (if licensed) for explicit confirmation of the fix advisory

Long-Term Hardening:

1. Segment the Qlik Sense environment from the broader corporate network
2. Place Qlik Sense behind a reverse proxy (e.g., Nginx, F5) with strict input validation and WAF rules
3. Implement least-privilege service accounts for Qlik Sense processes — the service account should not have local administrator rights
4. Apply a patch management SLA of 14 days for high-severity vulnerabilities in business-critical systems
5. Conduct a security review of all Qlik Sense configurations, including custom extensions and integrations
6. Enable comprehensive audit logging on both the Qlik Sense server and the underlying Windows OS

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55580
2. Qlik Sense Enterprise Windows Release Notes: https://community.qlik.com/ (official vendor community for patch announcements)
3. Qlik Support Portal: https://support.qlik.com/ (official vendor advisory channel)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2024-55580 NOT listed at time of writing)
5. Related Qlik Sense CVEs: CVE-2023-41265, CVE-2023-41266, CVE-2023-48365 (previous Qlik Sense RCE vulnerabilities — same product family, useful for understanding attack patterns)

Threat Actor Campaigns: No identity-group or nation-state attribution data is available for this CVE at the time of writing. Given the previous Qlik Sense vulnerabilities (CVE-2023-41265 et al.) were actively exploited by known ransomware groups (including Cactus ransomware reported in August 2023), there is elevated risk of exploitation-in-the-wild for CVE-2024-55580 in the coming months, though no confirmed exploitation campaigns have been reported yet. Monitor CISA KEV and threat intelligence feeds for updates.