CVE-2025-61138

Executive Summary

CVE-2025-61138 is an information disclosure vulnerability discovered in Qlik Sense Enterprise version 14.212.13. The flaw resides in the /dev-hub/ directory, which exposes sensitive data to unauthenticated or low-privileged attackers. This vulnerability can lead to the leakage of internal configuration details, user metadata, or other proprietary information, potentially aiding further attacks against the Qlik environment. No official patch has been released at this time, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): None (likely)
• Availability (A): None (likely)
• Threat Level: Medium (due to information disclosure potential)

Deep Dive & Mechanics

The /dev-hub/ directory in Qlik Sense Enterprise is intended for development and debugging purposes. It may expose endpoints that return internal application state, environment variables, or user session data. The vulnerability arises because access controls are insufficiently enforced, allowing any network-accessible user to query these endpoints without proper authentication. An attacker can enumerate the /dev-hub/ directory to discover API endpoints, configuration files, or logs that contain sensitive information such as database credentials, API keys, or internal network topology.

The exact mechanism involves HTTP GET requests to paths like /dev-hub/, /dev-hub/api/, or /dev-hub/config/. The server responds with JSON or XML data that should be restricted to administrative users. This information leak can be used to pivot to other services or escalate privileges within the Qlik environment.

Vulnerable vs. Patched Code

Vulnerable Code (Qlik Sense Enterprise v14.212.13): The /dev-hub/ directory is served without proper authentication middleware. Example of a vulnerable configuration snippet (pseudo-code):

// app.js (vulnerable)
app.use('/dev-hub', express.static('dev-hub'));
// No authentication check

Patched Code (Expected): A patched version would require authentication for all /dev-hub/ routes:

// app.js (patched)
app.use('/dev-hub', authenticate, express.static('dev-hub'));
// Where authenticate is a middleware that validates user session

Since no official patch is available, the above is a hypothetical fix. Organizations should implement their own access controls until an official update is released.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Qlik Sense Enterprise v14.212.13 in a controlled environment (e.g., Docker or VM).
2. Ensure the /dev-hub/ directory is accessible via HTTP on port 443 or 80.
3. Use a tool like curl or Burp Suite to probe the endpoint.

Exploitation Steps:

1. Send a GET request to the /dev-hub/ endpoint:

   curl -k https://target-qlik-server/dev-hub/
   

2. Enumerate subdirectories and files:

   curl -k https://target-qlik-server/dev-hub/api/
   curl -k https://target-qlik-server/dev-hub/config/
   

3. Parse the response for sensitive data (e.g., "db_password": "secret").

Expected Output:

{
  "environment": "production",
  "db_host": "internal-db.qlik.local",
  "db_user": "qlik_admin",
  "db_password": "P@ssw0rd!"
}

Blue Team

Detection:

• Monitor for unusual HTTP requests to /dev-hub/ paths from external IPs.
• Alert on any response containing keywords like password, secret, key, or token from these endpoints.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Immediately restrict access to /dev-hub/ using a reverse proxy (e.g., Nginx, Apache) with IP whitelisting or authentication.
• If possible, disable the /dev-hub/ directory entirely by removing the corresponding configuration.
• Monitor logs for any successful exploitation attempts and rotate any exposed credentials.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /dev-hub/, /dev-hub/api/, /dev-hub/config/
  • Unusual outbound connections from the Qlik server to external IPs (if data exfiltration occurs)
• File IOCs:
  • Log entries containing /dev-hub/ in access logs
  • Temporary files created in /tmp/ or /var/tmp/ with names like devhub_dump_*.txt
• Behavioral IOCs:
  • Unexpected changes to Qlik configuration files
  • New user accounts or privilege escalations within Qlik

Detection Engineering

YARA Rule

rule CVE_2025_61138_Qlik_DevHub_InfoLeak {
    meta:
        description = "Detects attempts to exploit CVE-2025-61138 by accessing /dev-hub/ directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61138"
    strings:
        $s1 = "/dev-hub/" ascii wide nocase
        $s2 = "dev-hub" ascii wide nocase
        $s3 = "Qlik Sense" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: Qlik Sense DevHub Information Disclosure Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to /dev-hub/ directory on Qlik Sense servers
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61138
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem:
            - "/dev-hub/*"
            - "/dev-hub"
    condition: selection
falsepositives:
    - Legitimate administrative access from trusted IPs
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-61138 Qlik Sense DevHub Information Disclosure Attempt"; flow:to_server,established; content:"/dev-hub/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to /dev-hub/ via firewall or reverse proxy rules.
   • Implement authentication for all /dev-hub/ endpoints using existing Qlik authentication mechanisms.
   • Monitor logs for any unauthorized access attempts.

2. Long-term Fix:

   • Apply an official patch from Qlik when available.
   • Upgrade to a patched version of Qlik Sense Enterprise.
   • Conduct a security audit of all exposed endpoints.

3. Compensating Controls:

   • Use Web Application Firewall (WAF) rules to block requests containing /dev-hub/.
   • Enable detailed logging and alerting for any access to development directories.
   • Implement network segmentation to isolate Qlik servers from untrusted networks.

Valters IT
Securing Digital Frontiers