CVE-2023-41266: Qlik Sense Path Traversal Vulnerability

CVE-2023-41266 Overview

CVE-2023-41266 is a path traversal vulnerability affecting Qlik Sense Enterprise for Windows. This vulnerability allows an unauthenticated remote attacker to generate an anonymous session, enabling them to transmit HTTP requests to unauthorized endpoints. The flaw impacts multiple versions of Qlik Sense Enterprise for Windows released between August 2022 and May 2023.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Organizations running vulnerable versions of Qlik Sense Enterprise for Windows should prioritize immediate patching.

Affected Products

• Qlik Sense Enterprise for Windows May 2023 Patch 3 and earlier
• Qlik Sense Enterprise for Windows February 2023 Patch 7 and earlier
• Qlik Sense Enterprise for Windows November 2022 Patch 10 and earlier
• Qlik Sense Enterprise for Windows August 2022 Patch 12 and earlier

Discovery Timeline

• August 29, 2023 - CVE-2023-41266 published to NVD
• October 31, 2025 - Last updated in NVD database

Technical Details for CVE-2023-41266

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in the Qlik Sense Enterprise for Windows platform, a business intelligence and data visualization solution. The vulnerability enables unauthenticated attackers to bypass authentication mechanisms and generate anonymous sessions through specially crafted requests containing path traversal sequences.

Once an anonymous session is established, attackers can leverage this access to transmit HTTP requests to endpoints that should be restricted to authenticated users. This vulnerability is particularly dangerous as it requires no authentication and can be exploited remotely over the network. The impact includes potential unauthorized access to sensitive data and the ability to interact with internal application functionality.

Root Cause

The root cause of CVE-2023-41266 lies in insufficient input validation within the Qlik Sense Enterprise web application. The application fails to properly sanitize user-supplied input containing path traversal sequences (such as ../ or encoded variants) before processing requests. This allows attackers to manipulate URL paths to access resources or functionality outside the intended directory structure, ultimately enabling the creation of unauthorized sessions.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or authentication. An attacker can exploit this vulnerability by sending specially crafted HTTP requests containing path traversal sequences to a vulnerable Qlik Sense Enterprise server. The attack flow typically involves:

1. An attacker identifies an internet-exposed Qlik Sense Enterprise for Windows instance
2. The attacker crafts malicious HTTP requests containing path traversal sequences
3. The vulnerable server processes these requests without proper validation
4. The attacker successfully generates an anonymous session
5. Using this session, the attacker can transmit requests to unauthorized internal endpoints

The vulnerability mechanism involves manipulating URL paths to bypass authentication controls. Attackers construct requests that traverse directories to reach authentication-related endpoints, ultimately generating valid session tokens without providing credentials. For detailed technical information, refer to the Qlik Security Advisory.

Detection Methods for CVE-2023-41266

Indicators of Compromise

• HTTP requests containing path traversal sequences (../, ..%2f, %2e%2e/) targeting Qlik Sense endpoints
• Unusual anonymous session creation activity in Qlik Sense logs
• HTTP requests to internal or administrative endpoints from unauthenticated sources
• Anomalous traffic patterns to the Qlik Sense proxy service

Detection Strategies

• Monitor web server and proxy logs for requests containing encoded or unencoded path traversal patterns
• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts
• Review Qlik Sense authentication logs for unexpected anonymous session creation events
• Deploy network intrusion detection signatures targeting path traversal exploitation patterns

Monitoring Recommendations

• Enable verbose logging on Qlik Sense Enterprise proxy and repository services
• Configure SIEM alerts for path traversal attack signatures against Qlik Sense infrastructure
• Monitor for unexpected outbound connections from Qlik Sense servers that may indicate post-exploitation activity
• Regularly audit session creation events and correlate with authentication records

How to Mitigate CVE-2023-41266

Immediate Actions Required

• Identify all Qlik Sense Enterprise for Windows installations within your environment
• Determine the current version and patch level of each installation
• Apply the appropriate security patches immediately based on your release branch
• If patching is not immediately possible, consider temporarily restricting network access to Qlik Sense servers

Patch Information

Qlik has released security patches to address this vulnerability. Organizations should upgrade to one of the following fixed versions:

• August 2023 IR (Initial Release) - For organizations ready to upgrade to the latest release
• May 2023 Patch 4 - For organizations on the May 2023 release branch
• February 2023 Patch 8 - For organizations on the February 2023 release branch
• November 2022 Patch 11 - For organizations on the November 2022 release branch
• August 2022 Patch 13 - For organizations on the August 2022 release branch

Patches are available through the Qlik Community Support Portal. Given that this vulnerability is included in CISA's Known Exploited Vulnerabilities catalog, federal agencies are required to remediate according to mandated timelines.

Workarounds

• Restrict network access to Qlik Sense Enterprise servers using firewall rules to allow only trusted IP ranges
• Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attack patterns
• Place Qlik Sense servers behind a reverse proxy with request filtering capabilities
• If possible, temporarily disable external access until patches can be applied

# Example: Restrict access to Qlik Sense using Windows Firewall
# Allow only internal network access to Qlik Sense default port
netsh advfirewall firewall add rule name="Qlik Sense Restricted" dir=in action=allow protocol=tcp localport=443 remoteip=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
netsh advfirewall firewall add rule name="Qlik Sense Block External" dir=in action=block protocol=tcp localport=443