CVE-2023-48365: Qlik Sense HTTP Tunneling Vulnerability

CVE-2023-48365 is an HTTP tunneling vulnerability in Qlik Sense. It lets an attacker escalate privileges and send HTTP requests to the backend server that hosts the product. Because this class of flaw can give unauthorized access to the hosting environment and because it has been used in ransomware activity, teams running Qlik Sense should treat it as a high-priority item and confirm exact impact against the vendor advisory.

CISA notes that organizations should apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. The remainder of this guidance focuses on practical detection, remediation, and interim controls for IT and security teams.

How it works

The underlying weakness is classified as CWE-444. In plain terms, the product mishandles or inconsistently interprets certain HTTP requests, enabling an attacker to tunnel or smuggle requests that the backend server processes with elevated privileges. According to the CISA summary, a successful attacker can escalate privileges and execute HTTP requests on the backend server hosting Qlik Sense.

Exact request construction, authentication bypass details, and any required preconditions are not provided here; those must be confirmed against the vendor advisory. In general for this weakness class, the attacker typically needs network reachability to the Qlik Sense interface and may leverage crafted headers or request framing that the front-end and back-end components interpret differently. The result is unauthorized actions on the hosting server rather than simple data disclosure from the application itself.

Am I affected? How to find it in your systems

Qlik Sense is commonly deployed as a business-intelligence and analytics platform, often on Windows servers or in virtualized/cloud environments that serve dashboards and data models to internal users. It may sit behind reverse proxies, load balancers, or web application firewalls and frequently listens on standard HTTPS ports.

• Inventory: Search asset-management, CMDB, and software-inventory tools for “Qlik Sense,” Qlik-related services, or known installation paths. Check Windows services, installed programs lists, and container images for Qlik components.
• Version and configuration check: Identify the exact build or release of every Qlik Sense instance. Compare those versions and any relevant configuration settings (especially HTTP handling, proxy, or authentication options) against the vendor advisory for CVE-2023-48365. Public detail on precise affected versions is limited here; the advisory is authoritative.
• Network exposure: Map which instances are reachable from untrusted networks or from large internal user populations. Note any reverse-proxy or WAF layers that terminate TLS in front of the product.
• Telemetry signs: Review web-server and application logs for anomalous HTTP methods, unexpected header combinations, or requests that appear to target backend administrative endpoints. Correlate with privilege-escalation indicators or unusual process activity on the hosting server. Absence of such logs does not prove safety; it only means exploitation was not observed in the available telemetry.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation package that addresses CVE-2023-48365, following the exact steps in the Qlik advisory. Confirm the fixed version or configuration change against that advisory before declaring systems remediated.

After patching, harden the deployment for this class of HTTP-handling weakness:

• Ensure reverse proxies and load balancers normalize or reject ambiguous HTTP requests so that front-end and back-end interpretations stay consistent.
• Restrict administrative and backend interfaces to management networks only.
• Enforce least-privilege service accounts for the Qlik Sense processes and the hosting operating system.
• Keep the underlying OS and any supporting web components fully patched and monitored.

CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Document the remediation date and verification method for audit purposes.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Network segmentation: Place Qlik Sense behind strict firewall rules or network ACLs that allow access only from trusted user subnets and jump hosts. Block direct internet exposure.
• Virtual patching / WAF: Deploy or tune a web application firewall or reverse-proxy rules that detect and block request-smuggling or tunneling patterns associated with CWE-444. Confirm rule efficacy against the vendor’s description of the vulnerability.
• Feature or interface disablement: If the advisory identifies a specific HTTP endpoint, proxy setting, or optional component that enables the tunneling path, disable it temporarily.
• Heightened monitoring: Increase logging verbosity for the Qlik Sense web tier and the hosting server. Alert on anomalous HTTP traffic, unexpected outbound connections from the server, or privilege-escalation events. Retain logs long enough for later forensic review.
• Access reduction: Temporarily revoke or tightly scope accounts that can reach the interface, and require multi-factor authentication where possible.

These measures lower risk but do not eliminate it; schedule the official patch as soon as operationally feasible. If no viable mitigation exists, follow CISA guidance and discontinue use until a fix is available.

If your data may have been exposed

Actively exploited vulnerabilities of this type, including those with known ransomware use, frequently lead to broader compromise of the hosting server and any data or credentials accessible from it. If logs or other indicators suggest successful exploitation, treat the incident as a potential breach: isolate the system, preserve forensic evidence, and follow your incident-response plan. Organizations can also run a free exposure scan of their email addresses against known breach data sets to determine whether related credentials or personal information have already appeared in public dumps.