CVE-2023-41265

CVE-2023-41265 is a critical-severity vulnerability in Qlik Qlik Sense with a CVSS 3.x base score of 9.6. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2023-12-07). The underlying weakness is classified as CWE-444.

Key facts

Description

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

CVE-2023-41265: Qlik Sense Enterprise HTTP Request Tunneling

AI-generated analysis based on the vulnerability data on this page.

Attribute Value
CVE ID CVE-2023-41265
CVSS v3.1 9.6 (CRITICAL)
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE CWE-444 (HTTP Request Smuggling / Inconsistent Interpretation of HTTP Requests)
EPSS 0.84967 (99.69th percentile)
KEV Yes — listed 2023-12-07
Vendor Qlik
Product Qlik Sense Enterprise for Windows

Summary

CVE-2023-41265 is a critical HTTP Request Tunneling vulnerability in Qlik Sense Enterprise for Windows. An authenticated remote attacker can craft malformed HTTP requests that the frontend proxy interprets differently than the backend repository application server. This desynchronization allows the attacker to "tunnel" or smuggle arbitrary HTTP requests through to the backend, effectively bypassing frontend access controls and elevating privileges. The vulnerability has a CVSS v3.1 score of 9.6 and is listed in CISA's Known Exploited Vulnerabilities catalog.

Background

Qlik Sense Enterprise is a popular business intelligence and data analytics platform deployed widely in enterprise environments. The Windows version uses a reverse-proxy architecture where an edge web server (commonly IIS or nginx) forwards client requests to an internal repository service that handles authentication, authorization, and application logic. When the frontend and backend disagree on message boundaries—typically due to discrepancies in handling Content-Length vs. Transfer-Encoding headers, or malformed line endings—an attacker can prepend a malicious request inside the body of an otherwise legitimate one. The frontend sees one request; the backend sees two.

Root Cause

The root cause is classified under CWE-444: Inconsistent Interpretation of HTTP Requests, commonly known as HTTP Request Smuggling or, in this specific case, HTTP Request Tunneling. The Qlik Sense frontend proxy and the backend repository server parse the same HTTP stream differently. Specifically:

  • The frontend may honor a Content-Length header and treat the entire payload as the body of a single request.
  • The backend may instead honor a Transfer-Encoding: chunked header (or vice versa), causing it to interpret a trailing portion of the payload as the start of a new, attacker-controlled request.

Because the smuggled request originates from the internal proxy's IP address, the backend often treats it as trusted traffic, skipping authentication or authorization checks that would normally apply to external requests.

Impact

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N tells a stark story:

  • Attack Vector (AV): Network — exploitable remotely without physical access.
  • Attack Complexity (AC): Low — no special conditions or race windows required.
  • Privileges Required (PR): Low — any authenticated user can trigger it.
  • User Interaction (UI): None — fully automatable.
  • Scope (S): Changed — the vulnerable component (proxy) is different from the impacted component (backend repository), amplifying blast radius.
  • Confidentiality (C): High — ability to read sensitive data from the repository.
  • Integrity (I): High — ability to modify configurations, users, or application state.
  • Availability (A): None — the vulnerability does not directly cause denial of service.

The EPSS score of 0.84967 (99.69th percentile) indicates that this CVE has a very high probability of being exploited in the wild. Its inclusion in the CISA KEV catalog with an exploitation date of 2023-12-07 confirms active, real-world exploitation.

Exploitation Walkthrough (Defensive Perspective)

Ethics Caveat: The following description is intentionally high-level and written from a defender's point of view. No weaponized exploit code is provided. Understanding the mechanics is essential for detection and remediation.

  1. Authentication. The attacker obtains low-privilege credentials to Qlik Sense (e.g., via phishing, credential stuffing, or a standard user account).

  2. Request Crafting. The attacker sends an HTTP request to the Qlik Sense proxy with conflicting length indicators—typically a request where the Content-Length and Transfer-Encoding headers disagree, or where chunked encoding is used to hide a second request inside the first.

  3. Desynchronization. The frontend proxy processes the request using one framing method (e.g., Content-Length). The remaining bytes in the TCP stream are forwarded to the backend.

  4. Backend Processing. The backend repository server interprets the leftover bytes as the beginning of a new HTTP request. Because this request appears to originate from the trusted proxy, it may bypass authentication checks or be treated as an administrative call.

  5. Privilege Escalation. The attacker can now invoke internal repository APIs—creating admin users, exporting sensitive apps, or reconfiguring security settings.

Defensive teams should treat any Qlik Sense instance older than the patched releases as critically exposed.

Affected and Patched Versions

Release Track Affected Patched
August 2022 Patch 12 and earlier Patch 13
November 2022 Patch 10 and earlier Patch 11
February 2023 Patch 7 and earlier Patch 8
May 2023 Patch 3 and earlier Patch 4
August 2023 — Initial Release (IR) — not vulnerable

Note: Only Qlik Sense Enterprise for Windows is affected. Qlik Sense SaaS and Qlik Cloud are not impacted by this vulnerability.

Remediation

  1. Upgrade immediately. Apply the latest patch for your release track (see table above). If you are on an unsupported track, upgrade to August 2023 IR or later.

  2. Compensating Controls (if patching is delayed):

    • WAF/Rate Limiting: Deploy a modern Web Application Firewall (WAF) with HTTP Request Smuggling rules enabled in front of Qlik Sense. Ensure the WAF normalizes ambiguous requests before forwarding.
    • Network Segmentation: Restrict Qlik Sense proxy access to known IP ranges. Do not expose the hub or QMC directly to the internet without additional filtering.
    • Disable Keep-Alive: As a temporary measure, disabling HTTP keep-alive between the proxy and backend can reduce the window for smuggling attacks, though this may impact performance.
    • Monitor for Anomalies: Increase logging verbosity on the proxy and backend to capture malformed requests or unexpected API calls from the proxy IP.

  3. Review Privileged Accounts: Audit all Qlik Sense administrator and root/admin accounts for unauthorized creation or permission changes.

Detection

  • Proxy Logs: Look for requests with both Content-Length and Transfer-Encoding: chunked headers reaching the Qlik Sense proxy.
  • Backend Logs: Monitor the repository application logs for API calls originating from the proxy's internal IP that do not have a corresponding authenticated session in the proxy logs.
  • SIEM Rules: Alert on:
    • Multiple HTTP methods in a single TCP stream to the Qlik Sense backend.
    • Unexpected POST or PUT requests to /api/v1/ or /qrs/ endpoints from internal proxy IPs.
    • Abnormal user-creation or privilege-escalation events in the Qlik Management Console (QMC) audit log.
  • Network Detection: Passive network monitors (e.g., Zeek, Suricata) can flag HTTP desynchronization attempts by analyzing header anomalies.

Assessment

CVE-2023-41265 is a textbook example of how architectural trust boundaries between proxies and backends can collapse when HTTP parsing is inconsistent. With a CVSS 9.6, EPSS > 0.84, and a confirmed CISA KEV listing, this is not a theoretical risk—it is an actively exploited, high-impact vulnerability affecting a widely deployed enterprise analytics platform.

Key lessons:

  1. Normalize at the edge. Reverse proxies must sanitize ambiguous HTTP framing before forwarding traffic to backend services.
  2. Trust but verify. Backend services should not implicitly trust requests based solely on source IP; re-authentication or signed tokens should be enforced for sensitive internal APIs.

If your organization runs Qlik Sense Enterprise for Windows and is not yet on a patched release, treat this as a patch-now event.

References

Frequently asked questions

What is CVE-2023-41265?
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
How severe is CVE-2023-41265?
CVE-2023-41265 has a CVSS 3.x base score of 9.6, rated critical severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2023-41265 being actively exploited?
Yes. CVE-2023-41265 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2023-12-07, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2023-41265?
CVE-2023-41265 primarily affects Qlik Qlik Sense. In total, 36 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-41265?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2023-41265 have an EU (EUVD) identifier?
Yes. CVE-2023-41265 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-45782. It is also flagged as exploited in the EUVD (since 2023-12-07).
When was CVE-2023-41265 published?
CVE-2023-41265 was published on 2023-08-29 and last updated on 2026-06-17.

References

Affected products (36)

More vulnerabilities in Qlik Qlik Sense

All CVEs affecting Qlik Qlik Sense →

Other CWE-444 (HTTP Request/Response Smuggling) vulnerabilities

Browse all CWE-444 (HTTP Request/Response Smuggling) vulnerabilities →