Executive Summary 

A security issue in Qlik Sense Enterprise for Windows has been identified, and patches have been made available. If successfully exploited, this vulnerability could lead to a compromise of the server running the Qlik Sense software, including unauthenticated remote code execution (RCE). This resolves an incomplete fix for CVE-2023-41265. 

This issue was identified and responsibly reported to Qlik by Adam Crosser and Thomas Hendrickson of Praetorian. 

Qlik has received reports that this vulnerability may be being used by malicious actors. Customers should confirm they have applied the necessary patches outlined in this bulletin. If there are additional questions, customers may log a case with Qlik Support. 

Affected Software 

All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted: 

• August 2023 Patch 1
• May 2023 Patch 5
• February 2023 Patch 9
• November 2022 Patch 11
• August 2022 Patch 13
• May 2022 Patch 15
• February 2022 Patch 14
• November 2021 Patch 16

Severity Rating 

Using the CVSS V3.1 scoring system (https://nvd.nist.gov/vuln-metrics/cvss), Qlik rates this severity as critical.  

Vulnerability Details

CVE-2023-48365 (QB-21683) HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows

Severity: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical)

Due to improper validation of HTTP Headers a remote attacker is able to elevate their privilege by tunnelling HTTP requests, allowing them to execute HTTP requests on the backend server hosting the repository application. This resolves an incomplete fix for CVE-2023-41265.

Resolution 

Recommendation 

Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. Fixes are available for the following versions: 

• November 2023 IR
• August 2023 Patch 2
• May 2023 Patch 6
• February 2023 Patch 10
• November 2022 Patch 12
• August 2022 Patch 14
• May 2022 Patch 16
• February 2022 Patch 15
• November 2021 Patch 17

These patches include the fixes for previous issues CVE-2023-41266 and CVE-2023-41265 (link). 

All Qlik software can be downloaded from our official Qlik Download page (customer login required).

Edit December 1st, 2023: Added November 2023 IR release to clarify it is not affected

Does Qlik have a defined security policy?

Qlik takes the security of our products seriously.  We have a dedicated team of security experts working on testing, hardening and securing our products.  We also work closely with external security companies, our customers and partners to ensure the security of our products is of the highest standard.  

Our Qlik Trust and Compliance Center provides details for compliance and security questions across all Qlik products. 

What do I do if I find a security vulnerability in a Qlik product?

Please report any security vulnerability concern to Qlik Support. For an accurate an detailed evaluation of a potential security vulnerability, it is important to clear describe the scenario in which a vulnerability has been exposed. This includes describing the steps for how security is compromised and what detail can be exposed by an attacker.

Notice, that generic test reports from 3rd auditing tools typically do not include detailed steps of vulnerability exposure in their security report. These reports commonly referring to potential risk based patterns, they do not actually expose a vulnerability as part of their system evaluation. Consequently this means that the default report details are not enough for Qlik to take any immediate action on based on the raised concern. Please consult 3rd party security auditor or local security expert for complete test case details before reporting support case with Qlik. 

To enable qualified and efficient investigation and action by Qlik, please report each vulnerability concern as an individual support case with Qlik Support. This means that each concern raised in a 3rd party test report must be reported as a separate support case.

For each case consider adding as much detail as possible, in line with below items:

• Qlik product name
• Qlik product version
• Test case subject/name (if based on test report)
• Complete penetration test report (attach full report for reference)
• Name of security tool used for testing
• Details of how to replicate the vulnerability
  • Step by step description on how to expose vulnerability
  • Recording of reproduction
  • Supporting material, e.g. logs, traffic traces or screenshots
• Vulnerability impact
  • Type of information exposed
  • Unauthorized access to content
• CVSS score if provided by security auditor

PostgreSQL has identified two security issues. As Qlik Sense Enterprise on Windows relies on PostgreSQL for its repository, we want to provide you with steps on how to mitigate the vulnerabilities.

• CVE-2023-2454
  
  This enabled an attacker having database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. Database owners have that right by default, and explicit grants may extend it to other users.
  
  
• CVE-2023-2455 
  
  While CVE-2016-2193 fixed most interaction between row security and user ID changes, it missed a scenario involving function inlining. This leads to potentially incorrect policies being applied in cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.

Resolution

With the next major Qlik Sense Enterprise on Windows release (August 2023), Qlik will update its bundled PostgreSQL database to the latest 14.x version.

As a mitigation for any previous releases, including May 2023, we offer the Qlik Postgres Installer (QPI) to migrate from 9.6 or 12.5 embedded databases to 14.8. We validated PostgreSQL 14.x for all releases back to February 2022.

Download the Qlik Postgres Installer versions 1.3.0 here.

There are two possible scenarios which may apply to you:

Scenario 1

Upgrading your PostgreSQL database for Qlik Sense February 2022 (or later) while not having used the QPI yet

Use the new Qlik Postgres Installer (version 1.3.0) to upgrade to Postgres 14.8 and migrate Postgres with QPI. Follow the instructions in Upgrading Qlik Sense Repository Database using the Qlik PostgreSQL Installer.

Download the Qlik Postgres Installer versions 1.3.0 here.

Scenario 2

Upgrading your PostgreSQL on February 2022 (or later) if you have already migrated to 12.x within QPI

If you have previously used the Qlik Postgres Installer (version 1.2.1 or earlier), you can simply install the latest PostgreSQL version (within your major release) and install it on top of your current 12.x database.

Steps:

1. Download the latest PostgreSQL installer within the major release you have installed (Download PostgreSQL | Enterprisedb.com).
   
   Example: You have used the old QPI to upgrade to 12.5. You can now easily upgrade to a later version in the same major release, such as 12.15.
   
   
2. Stop the Qlik Sense services. Leave the postgresql-x64-12 service running. 
   
   
3. Run the downloaded installer as an administrator.
   
   
4. The installer will guide you through the upgrade procedure. 
   
   
5. Start the Qlik Sense services.

Related Content

https://www.cybersecurity-help.cz/vdb/SB2023051138
Download PostgreSQL | Enterprisedb.com

Environment

Qlik Sense Enterprise on Windows all versions

Executive Summary 

Two security issues in Qlik Sense Enterprise for Windows have been identified and patches made available. If the two vulnerabilities are combined and successfully exploited, these issues could lead to a compromise of the server running the Qlik Sense software, including unauthenticated remote code execution (RCE). 

These issues were identified and responsibly reported to Qlik by Adam Crosser and Thomas Hendrickson of Praetorian. 

Qlik has received reports that this vulnerability may be being used by malicious actors. Customers should confirm they have applied the necessary patches outlined in this bulletin. If there are additional questions, customers may log a case with Qlik Support. 

Affected Software 

All versions of Qlik Sense Enterprise for Windows prior to and including these releases are impacted: 

• May 2023 Patch 3
• February 2023 Patch 7
• November 2022 Patch 10
• August 2022 Patch 12

Severity Rating 

Using the CVSS V3.1 scoring system (https://nvd.nist.gov/vuln-metrics/cvss), Qlik rates one as high severity and one as critical. 

Vulnerability Details

CVE-2023-41266 (QB-21220) Path traversal in Qlik Sense Enterprise for Windows 

Severity: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (8.2 High) 

Due to improper validation of user supplied input, it is possible for an unauthenticated remote attacker to generate an anonymous session which allows them to perform HTTP requests to unauthorized endpoints. 

CVE-2023-41265 (QB-21222) HTTP Tunneling vulnerability in Qlik Sense Enterprise for Windows 

Severity: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical) 

Due to improper validation of HTTP Headers a remote attacker is able to elevate their privilege by tunnelling HTTP requests, allowing them to execute HTTP requests on the backend server hosting the repository application. 

Resolution 

Recommendation 

Customers should upgrade Qlik Sense Enterprise for Windows to a version containing fixes for these issues. Fixes are available for the following versions: 

• August 2023 Initial Release 
• May 2023 Patch 4 
• February 2023 Patch 8 
• November 2022 Patch 11 
• August 2022 Patch 13 

All Qlik software can be downloaded from our official Qlik Download page (customer login required).

Content-Security-Policy (current) or X-XSS-Protection (outdated) headers are not set by default after installing Qlik Sense Enterprise on Windows. 

While potentially great for improving site security, Qlik has no authority over the environment Qlik Sense is deployed in. If the specific custom header or other headers are deemed necessary, they can be added to the virtual proxy from the Qlik Sense Enterprise Management panel. See Qlik Sense for Administrators: Virtual Proxies.

Related Content

Qlik Sense Enterprise on Windows: Securing and Hardening Server 

Security vulnerability scan report may refer to "System Information Leak" in the response from the About Service API end-point /api/about/v1/thirdParty.

This API returns a list of third-party software that is installed in the product. Details include information about copyright, version, licensing, and legal notices.

The disclaimer text of some third-party components may include IP address references. These references come from the third-party provider's disclaimer or open-source license details. The IP address references do not refer to details from the installed environment.

For example, an internal IP address (10.x.x.x) is referred to in the disclaimer text for the Torch Cephes Math Library. This reference is part of the library's open-source license https://github.com/deepmind/torch-cephes/blob/master/LICENSE.txt.

Resolution

Third-party software details contain disclaimer text as required for the third-party software provider. 
IP references in third-party software disclaimers can be considered false-positive test results.

Qlik can not alter the third-party vendor disclaimers. 

Related Content 

Third Party: Get | Qlik Sense for developers Help 
False Positive 

Environment

Qlik Sense Enterprise on Windows 

QlikView is an identity consumer, not an authentication provider. Based on this premise, QlikView cannot support Multi-Factor Authentication.

If the identity provider can pass the identity to QlikView in a manner it can consume after it's authenticated, then it would work. Still, it is a matter of sending an identity in a format QlikView can consume.

As such, MFA (Multi-Factor Authentication) is not supported.

Qlik Cloud and Qlik Sense Enterprise on Windows support Multi-Factor Authentication.

Related Content:

Qlik Cloud: Configuring Multi-Factor Authentication (MFA)
Qlik Sense Enterprise on Windows: Authentication solutions 

To address CVE-2022-37026, upgrade Qlik NPrinting to any version past May 2022 SR3.

Environment

Qlik NPrinting 

Internal Investigation ID(s) 

00061646

A third-party certificate was configured in the Qlik Sense Proxy, but is not being used.

The connection is not private" NET::ERR_CERT_COMMON_NAME_INVALID may be displayed on HUB access. 

Qlik Sense Enterprise on Windows uses self-signed and self-generated certificates to protect communication between services, as well as user web traffic to the hub and management console.  It is possible to use a third-party-issued SSL certificate to protect client web traffic. Using the self-signed certificate will cause a certificate warning to be displayed in the web browser (such as Google Chrome or Internet Explorer). 

If the third-party certificate for the Qlik Sense Proxy Service is not fully compatible with Qlik Sense or it does not have the correct attributes and cyphers, the Qlik Sense Repository Service will revert to using the default certificates. The following error may occur in the Proxy Security logs:

Example:  C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\HOSTNAME_Security_Proxy.txt

No private key found for certificate 'CN=qliksense.domain.com' ([CERTIFICATE THUMBPRINT HERE]) Couldn't find a valid ssl certificate with thumbprint [CERTIFICATE THUMBPRINT HERE] Reverting to default Qlik Sense SSLCertificate Set certificate 'CN=qliksenseserver1.domain.com' ([CERTIFICATE THUMBPRINT HERE]) as SSL certificate presented to browser

Resolution:

In order for Qlik Sense Enterprise to correctly recognize the third-party certificate as valid, the certificate will have to meet the following requirements:

Note: Root and Intermediate CA certificates need to be correctly installed. Should any be missing, Qlik Sense proxy will not use the server certificate and will revert back to using the self-signed certificate instead.

Certificates that are known to work well with Qlik Sense have the following attributes:

• Certificates that are x509 version 3. More information including filename extensions under https://en.wikipedia.org/wiki/X.509 
• Use signature algorithm sha256RSA
• Use signature hash algorithm sha256
• Signed by a valid, and OS/browser configured , CA
• Are valid according to date restrictions (valid from/valid to)
• Key in format CryptoAPI (not in CNG)
• The certificate itself has to contain private key no matter what Qlik Sense version.

 Related Content:

How to: Change the certificate used by the Qlik Sense Proxy to a custom third party certificate 

 

It was reported that Qlik Replicate May 2022 (2022.5.0.291) version reports a Java SE vulnerability:    

Plugin Output: Path              : /opt/attunity/replicate/jvm/  Installed version : 11.0.14 Fixed version     : Upgrade to version 11.0.16 or greater CVE-2022-21426,CVE-2022-21434,CVE-2022-21443,CVE-2022-21449,CVE-2022-21476,CVE-2022-21496 CVE-2022-21540,CVE-2022-21541,CVE-2022-21549,CVE-2022-25647,CVE-2022-34169

Environment

• Qlik Replicate version May 2022
• Linux

Resolution

Qlik Data Integration products use JVM version 11 for QEM/Replicate and also JVM version 8 for Compose.

There is no need to patch Qlik Replicate itself. 

To address the security report, you can independently upgrade Java SE to 11.0.17 on the server Qlik Replicate is running on.

Internal Investigation ID(s) 

7345

A security scan may report that Qlik Replicate instances are non-PCI compliant due to weak SSL ciphers on ports 443, 3389 and 3552.

Out of these ports, 443 and 3552 are used by Qlik. Port 3389 is RDP.

Environment

• Qlik Replicate 
• Windows

Resolution

The security of Qlik products does not depend only on the Qlik software. It also relies on the security of the environment that, in this case, Qlik Replicate operates in. This means that the security of, for example, the operating system and the cryptographic protocols (such as TLS/SSL) has to be set up and configured to provide the security needed for Qlik Replicate.

Qlik cannot offer advice on how to configure Windows to disable certain ciphers which customer security guidelines forbid.

For information on how to mitigate these reports, please see: https://learn.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings.

Lucky 13 and Sweet 32 are the versions which are not compliant for port 3552.

Luck-13 (https://crashtest-security.com/prevent-ssl-lucky13/) and Sweet-32 (https://crashtest-security.com/prevent-ssl-sweet32/) are not versions, nor are they ciphers that Replicate uses on port 3552. Those are old vulnerabilities (5Y+) that are either mitigated in the version of OpenSSL currently used in Qlik Replicate (with its cipher selection) or is otherwise impractical or irrelevant in the way Qlik Replicate works. 

HTTP Response Header exposes Microsoft-HTTPAPI/2.0 as the server source. An attacker could use this information to expose known vulnerabilities for the server source.

Resolution

This header is included in the HTTP header by .NET framework, which means it can not be directly controlled by Qlik software. 

Environment

Qlik Sense Enterprise on Windows, all version
QlikView, all versions
Qlik NPrinting, all versions

Internal Investigation IDs:

• QLIK-90522

In Qlik Sense and QlikView, using the default setup, it is possible to embed a Qlik Sense site or a QlikView App into an iframe external to the site and, potentially, capture credentials.

The main defence against this potential vulnerability is to set the X-Frame-Options Response Headers in the requests. This governs whether a browser should or should not render a page inside an iFrame.

There are a handful of values that can be configured. The support for those dependent on the web browser, so do investigate the type of X-Frame-Option that you are setting.

Qlik Sense

1. Open the Qlik Sense Management Console
2. Navigate to the Virtual Proxy used in the implementation
3. Click Edit
4. Select Advanced in the right-hand side menu
5. Locate Additional response headers 
6. Add: X-Frame-Options: SAMEORIGIN 

QlikView

QlikView allows for the use of custom headers (much like Qlik Sense) natively beginning with the 12.30 release.

See QlikView WebServer: Custom HTTP Header.

You can also implement them using IIS if IIS is being used as the web server: Setting Custom HTTP Headers in IIS for QlikView.

Related Content

How to allow Qlik Sense to be embedding in an iFrame only from specific websites

Environment

QlikView 
Qlik Sense Enterprise on Windows 

Are Qlik products affected by OpenSSL vulnerability CVE-2022-3996?

No, Qlik Products do not use the versions impacted by this vulnerability and are therefore not affected by it. 

How to mitigate if an attacker uploads a malicious file in the application with a double extension in Qlik Sense?

The XML files can be used for data ingestion. By default XML is disabled, but we do provide the ability to allow list XML as a data type.

Uploading an XML with Javascript (XSS) will allow a malicious user to run code in the context of the targeted user's session.

Environment

Qlik Sense Enterprise on Windows February 2022 and previous versions.

Resolution

Add the following flag in the "C:\Program Files\Qlik\Sense\Repository\Repository.exe.conf" file,

<!-- Flag will enable to scan for script tags in the uploaded XML files through the ContentLibrary or AppContent-->
<add key="ScanXmlFileForScripts" value="true" />

Upon detecting the script within the XML file, the User will be warned that the file can not be uploaded.

Or the below error based on the Qlik Sense version,

Fix Version:

Qlik Sense Enterprise on Windows May 2022.

• Uploading objects to content libraries
• Uploading an image to the app content folder

Cause

• QB-1693
• QB-8378
• QB-11820

To allowlist XML files in Qlik Sense May 2022 and later versions, please contact the Qlik Support Team via Live chat or Submit a case!

Disclaimer: Encrypted communication between PostgreSQL database and Qlik Sense services is a supported setup. This article provides general guidance on how to enable encryption on PostgreSQL database server, but local adjustment must be applied to comply with local IT requirements. Please be aware that Qlik Support can not help setting up Database Traffic Encryption, while Qlik Consulting Services may be utilized for deployment implementation. 

Qlik Sense supports database traffic encryption using SSL/TLS, but it is not enabled by default. The Qlik Sense installer cannot use SSL encryption for establishing a connection to PostgreSQL. When SSL encryption is enabled, the installer does not recognize any already installed PostgreSQL databases, and as a consequence, installation cannot be completed. Password security and local IT policy around certificate need to be considered before enabling database encryption, as the implementation includes manual configuration of the Qlik Sense deployment.

Qlik recommends that the configuration in this section is performed by someone with sufficient skills in PostgreSQL database configuration.

This article covers two scenarios for enabling Database Traffic Encryption;

1. PostgreSQL database installed locally with the Qlik Sense installer
2. Qlik Sense referred to the existing database during the installation 

Upgrades: Prior to Qlik Sense Enterprise August 2022 release, the Qlik Sense installer cannot use SSL encryption for establishing a connection to PostgreSQL. So any upgrades will fail unless you are upgrading to August 2022 and later. Prior to upgrading, disable the encryption. You can enable it again after the upgrade is complete.

See Unable to upgrade Qlik Sense with missing 'SenseServices', 'QSMQ', and 'Licenses' database for respective capabilities.

Always take a complete backup of Qlik Sense deployment before altering system configuration, to allow restoring a working state in case of disaster. 

These scenarios apply the default Qlik Sense signed certificate to encrypt traffic for a PostgreSQL database. Qlik Sense signed certificate is commonly only fully trusted by Qlik Sense nodes, which means other usage may not comply with local IT policies.  It is recommended that a fully trusted certificate is used when applying encrypted database traffic for production environments. Consult the local IT department for details on retrieving a fully trusted certificate. 

Scenario 1: PostgreSQL database installed locally with the Qlik Sense installer 

This scenario assumes a standard Qlik Sense installation, where the Qlik Sense Repository Database is installed on the Qlik Sense central node as part of the Qlik Sense installation. 

1. Complete installation of Qlik Sense Enterprise on Windows as described in Qlik Sense Help for Administrators: Installing Qlik Sense Enterprise on Windows. 
2. Enable encryption as described in Qlik Sense Help for Administrators: Database traffic encryption

Scenario 2: Qlik Sense referred to the existing database during the installation 

This scenario assumes a custom Qlik Sense installation, where Qlik Sense is configured to use a dedicated PostgreSQL database as its Repository Database. 

1. Install and configure a standalone PostgreSQL database server as described in Qlik Sense Help for Administrators: Installing and configuring PostgreSQL 
2. Install Qlik Sense central node connected to an existing repository database as described in Qlik Sense Help for Administrators: Installing Qlik Sense on a single node
3. Install Qlik Sense rim nodes if required as described in Qlik Sense Help for Administrators: Installing Qlik Sense in a multi-node site 
4. Enable encryption PostgreSQL database and all Qlik Sense nodes as described in Qlik Sense Help for Administrators: Database traffic encryption