Qlik Sense Enterprise for Windows HTTP Request Tunneling & Privilege Escalation Vulnerability (CVE-2023-41265) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTQlik Sense Enterprise for Windows (May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier)
A remote attacker can elevate privileges and execute unauthorized commands on the backend repository application by tunneling malicious HTTP requests.
Immediately upgrade to the patched versions: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators must upgrade Qlik Sense Enterprise for Windows to the designated patch levels or higher. Use the following PowerShell commands to verify the current version and prepare for the upgrade.
# 1. Check the currently installed Qlik Sense version
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*Qlik Sense*' } | Select-Object Name, Version
# 2. Download the appropriate patch installer (e.g., May 2023 Patch 4 or later) and run the installer with administrative privileges
Start-Process -FilePath '.\Qlik_Sense_setup.exe' -ArgumentList '/quiet /passive' -Wait2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the Qlik Sense proxy ports (default 80/443) using network firewalls or security groups, allowing access only from trusted IP ranges or VPNs. If using an upstream reverse proxy like Nginx, enforce strict header validation.
# Nginx hardening configuration to mitigate HTTP request smuggling/tunneling
server {
listen 443 ssl;
server_name qlik.company.internal;
# Enforce strict HTTP parsing and disable invalid headers
ignore_invalid_headers on;
client_max_body_size 10M;
keepalive_timeout 65;
location / {
proxy_pass https://qlik_backend_servers;
proxy_http_version 1.1;
proxy_set_header Connection '';
proxy_set_header Host $host;
}
}3. Log Audit & IoC Verification Commands
Inspect Qlik Sense Proxy and Repository logs for anomalies such as unexpected HTTP 400 errors, duplicate Content-Length headers, or unauthorized API calls to the repository service.
# Search Qlik Sense Proxy logs for potential exploitation attempts or unauthorized repository access
$LogDirectory = 'C:\ProgramData\Qlik\Sense\Log\Proxy\'
$SearchPatterns = @('Repository', 'Unauthorized', '400 Bad Request')
foreach ($pattern in $SearchPatterns) {
Write-Host "Scanning logs for: $pattern" -ForegroundColor Yellow
Get-ChildItem -Path $LogDirectory -Filter '*.log' | Select-String -Pattern $pattern | Select-Object -First 20
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-41265) is an HTTP Request Tunneling vulnerability (CWE-444) residing in Qlik Sense Enterprise for Windows. The root cause lies in the improper validation and parsing of HTTP request headers by the frontend proxy service when forwarding requests to the backend repository application. This discrepancy in HTTP parsing allows an attacker to desynchronize the connection state between the proxy and the backend.
2. Exploitation Mechanics & Attack Scenario
An attacker can craft a raw HTTP request containing embedded or smuggled HTTP requests within a single TCP connection. While the frontend proxy interprets the payload as a single request, the backend repository server parses it as multiple distinct requests. This allows the attacker to bypass frontend authentication controls and inject arbitrary requests directly into the backend repository API, leading to unauthorized privilege escalation.
3. Infrastructure & Business Impact
With a CVSS score of 9.9 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat. Successful exploitation allows remote attackers to gain administrative access to the Qlik Sense repository, potentially leading to data exfiltration, unauthorized configuration changes, or full compromise of the underlying Windows server hosting the application.
Official Vendor Advisories & References
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
Frequently Asked SecOps Questions (CVE-2023-41265)
FAQQ1. How critical is CVE-2023-41265 and is it actively exploited in the wild?
CVE-2023-41265 is rated CVSS 9.9 (CRITICAL) with a 30-day EPSS exploitation probability of 88.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-41265?
Primary impacted vendors include qlik across qlik sense enterprise for windows. Scope summary: Qlik Sense Enterprise for Windows running the following versions: - May 2023 Patch 3 and earlier - February 2023 Patch 7 and earlier - November 2022 Patch 10 and earlier - August 2022 Patch 12 and earlier
Q3. What temporary mitigations or workarounds exist for CVE-2023-41265 before patching?
[Mitigation] Immediately upgrade to the patched versions: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-41265
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (qlik)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.