Qlik Sense Enterprise for Windows HTTP Request Tunneling Remote Code Execution Vulnerability (CVE-2023-48365)
Executive & SecOps Summary
SECOPS ASSESSMENTQlik Sense Enterprise for Windows (prior to specified patch levels)
Unauthenticated remote attackers can elevate privileges and execute arbitrary code on the backend repository server via HTTP request tunneling.
Immediately apply the official security patches (August 2023 Patch 2 or later, etc.) provided by the vendor.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Download and install the appropriate patch for your release version from the Qlik Support Portal.
# Stop Qlik Sense services before applying the patch
Stop-Service -Name 'QlikSenseRepositoryService' -Force
Stop-Service -Name 'QlikSenseProxyService' -Force
# Execute the downloaded patch installer in silent mode
Start-Process -FilePath 'C:\Path\To\QlikSensePatch.exe' -ArgumentList '/quiet /norestart' -Wait
# Restart services after installation
Start-Service -Name 'QlikSenseRepositoryService'
Start-Service -Name 'QlikSenseProxyService'2. Temporary Workaround & Hardening Configuration
Restrict access to Qlik Sense proxy ports (default 80, 443, 4244) using firewalls or security groups, allowing traffic only from trusted IP ranges or VPNs.
# Example Nginx reverse proxy configuration to strip suspicious headers
server {
listen 80;
server_name qlik.internal;
location / {
proxy_pass http://qlik_backend;
# Strip internal headers from external requests to prevent spoofing
proxy_set_header X-Qlik-User '';
proxy_set_header Connection '';
}
}3. Log Audit & IoC Verification Commands
Inspect Qlik Sense proxy and repository logs for indicators of unauthorized internal API calls or header manipulation.
# Search Qlik Sense Proxy Audit logs for suspicious repository connector activity
$LogPath = 'C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\*Proxy_Audit*.txt'
Select-String -Path $LogPath -Pattern 'Repository.RepositoryConnector' | Select-Object -First 20Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-48365) is a critical HTTP request smuggling/tunneling flaw in Qlik Sense Enterprise for Windows. It exists due to an incomplete fix for the previously addressed CVE-2023-41265. The proxy service fails to properly validate and sanitize incoming HTTP headers, allowing attackers to inject malicious headers into backend requests.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can craft and send HTTP requests containing manipulated headers. Because of improper validation, the proxy tunnels these requests directly to the backend repository application. This enables the attacker to execute administrative HTTP requests on the backend server as if they originated from a trusted internal source, leading to privilege escalation and remote code execution.
3. Infrastructure & Business Impact
With a CVSS score of 9.9 (Critical) and its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an active threat. Successful exploitation allows attackers to bypass authentication, compromise sensitive business intelligence data, and gain full control over the hosting infrastructure.
Official Vendor Advisories & References
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.
Frequently Asked SecOps Questions (CVE-2023-48365)
FAQQ1. How critical is CVE-2023-48365 and is it actively exploited in the wild?
CVE-2023-48365 is rated CVSS 9.9 (CRITICAL) with a 30-day EPSS exploitation probability of 47.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-48365?
Primary impacted vendors include qlik across qlik sense enterprise for windows. Scope summary: Qlik Sense Enterprise for Windows versions prior to the following patch levels: - August 2023 Patch 2 - May 2023 Patch 6 - February 2023 Patch 10 - November 2022 Patch 12 - August 2022 Patch 14 - May 2022 Patch 16 - February 2022 Patch 15 - November 2021 Patch 17
Q3. What temporary mitigations or workarounds exist for CVE-2023-48365 before patching?
[Mitigation] Immediately apply the official security patches (August 2023 Patch 2 or later, etc.) provided by the vendor. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-48365
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (qlik)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.