Qlik Sense protection against POODLE/GOLDENDOODLE attack and Insecure renegotiation

[Bjorn_Wedbratt]

Analyzing endpoints for Qlik Sense Enterprise on Windows, using for example https://www.ssllabs.com/ssltest/analyze.html may indicate:

• The site being vulnerable for POODLE attacks and Insecure renegotiation
• Certificates using SHA1 instead of SHA256 cipher
• Potential CVE-2019-1559 vulnerability

Environment:

Qlik Sense Enterprise on Windows 

 

Protecting the platform

Please review Qlik Sense Enterprise on Windows securityfor information on how to protect the Qlik Sense platform. 

The security in Qlik Sense Enterprise does not depend only on the Qlik software. It also relies on the security and hardening of the environment that Qlik Sense operates in. This means that the security of, for example, the operating system and the cryptographic ciphers available have to be set up and configured to provide the security needed for Qlik Sense.

See Qlik Sense: TLS Support on what protocols and ciphers are supported in which version. 

Mitigate POODLE attack

To mitigate POODLE attacks, one step is to completely disable SSLv3.0 on the server. 
See Microsoft Security Advisory 3009008 for more instructions on how to accomplish this and the impact of doing so.
See Qlik Sense: TLS Support on what protocols and ciphers are supported in which version. 

Mitigate Zombie POODLE / GOLDENDOODLE attack

To mitigate POODLE attacks, one step is to completely disable all cipher suites with the string CBC. This needs to be carried out in the Windows OS.

Insecure renegotiation

Insecure renegotiation may be mitigated by disabling renegotiation. This can be done at the OS level by adding the following Windows registry key:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL]
"DisableRenegoOnServer"=dword:00000001

However, it is recommended to review all Schannel settings ( Secure Channel ) and that a Windows Administrator should configure it to meet their requirements.

See Qlik Sense: TLS Support on what protocols are supported in which version. 


Note: Any changes at the OS level must be thoroughly tested as they may cause other software to no longer function as expected, or clients may be unable to communicate with the server. If any side effects are experienced, the changes should be reverted back to the original settings.

[Anwendungsmanagement]

Hi Support-Team,

we have started to scan our servers with a security platform and a TLS padding oracle vulnerability is detected and triggered by proxy.exe.

To mitigate that threat we followed your advice by completely disabling all cipher suites with the string CBC.

That results in the behavior that qlik can no longer be accessed via the browser, so i revoked the settings and the threat has been reopened.

Do you have another solution to mitigate the Zombie POODLE / GOLDENDOODLE attack?

Best regards

[Sonja_Bauernfeind]

Hello @Anwendungsmanagement 

This will likely require more troubleshooting than we can do in an article. I recommend to first post your issue in our Qlik Sense Deployment and Management forum. Make certain to add the following:

• version of Qlik Sense you are using
• operating system used
• what you have done
• what error messages you encountered (both onscreen as well as in your log files: Troubleshooting Qlik Sense Enterprise on Windows using logs | How To Collect Log Files From Qlik Sense Enterprise on Windows)

All the best,
Sonja 

All the best,
Sonja 

[veera_a]

@Sonja_Bauernfeind -We are using Nov 2023 Patch 9 and this Vulnerability has been flagged .Is Qlik going to address this in future version ? and what is permanent fix instead of work around by disabling the ciphers?

Thanks
Veer

[Sonja_Bauernfeind]

Hello @veera_a 

Please review the documented mitigations on how to address this. The disabling of ciphers is not a workaround, but the required solution, as this is where the vulnerability is present.

All the best,
Sonja