CVE-2024-55579 Overview
CVE-2024-55579 affects Qlik Sense Enterprise for Windows releases prior to November 2024 IR. An unprivileged user with network access can create connection objects that trigger execution of arbitrary .exe files on the server. The flaw maps to [CWE-863: Incorrect Authorization], allowing actions that should require elevated privileges to be performed by low-privileged accounts. Qlik addressed the issue across multiple supported release trains, including November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.
Critical Impact
An authenticated, unprivileged attacker with network access can achieve arbitrary executable execution on the Qlik Sense server, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- Qlik Sense Enterprise for Windows versions before November 2024 IR
- Qlik Sense Enterprise for Windows May 2024 releases before Patch 10
- Qlik Sense Enterprise for Windows February 2024, November 2023, August 2023, May 2023, and February 2023 release trains before their respective fix patches
Discovery Timeline
- 2024-12-09 - CVE-2024-55579 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2024-55579
Vulnerability Analysis
The vulnerability resides in how Qlik Sense Enterprise handles connection objects created by authenticated users. Connection objects in Qlik Sense define how the platform reaches external data sources and can reference executable paths or commands during data load operations. The server fails to enforce sufficient authorization checks on which users may create or modify connection objects that resolve to executable files. As a result, an unprivileged user who can authenticate to the Qlik Sense service over the network can craft a connection object that causes the server process to execute an arbitrary .exe on the host. Because Qlik Sense services typically run with elevated service account privileges on the Windows host, successful exploitation provides the attacker with code execution in the security context of that service account.
Root Cause
The root cause is an authorization gap classified as [CWE-863]. The connection object creation workflow does not adequately validate whether the requesting principal is authorized to define connections that invoke local executables. Privileged functionality is exposed through an interface accessible to low-privileged authenticated users.
Attack Vector
The attack vector is network-based and requires user interaction within the Qlik Sense environment. An attacker authenticates to Qlik Sense with a low-privilege account, submits a connection object referencing an attacker-supplied executable path, and triggers a workflow that loads or refreshes data using that connection. The connection object handler then invokes the referenced .exe, resulting in arbitrary code execution on the server. Technical details are described in the Qlik Support Security Fixes advisory.
Detection Methods for CVE-2024-55579
Indicators of Compromise
- Unexpected child processes spawned by Qlik Sense service binaries such as Engine.exe, Scheduler.exe, or Repository.exe
- New or modified connection objects in the Qlik Management Console that reference executable paths, batch files, or scripts
- Qlik Sense audit log entries showing connection object creation by accounts that do not normally administer connections
Detection Strategies
- Inventory connection objects via the Qlik Repository Service API and flag any whose target resolves to a local executable, script, or UNC path under user-writable directories
- Correlate Qlik Sense engine process telemetry with connection object change events to identify executions tied to recently created or modified connections
- Hunt for anomalous process lineage where Qlik service accounts launch interpreters such as cmd.exe, powershell.exe, or unsigned binaries
Monitoring Recommendations
- Enable and centralize Qlik Sense audit logs, focusing on the AuditActivity.Repository and AuditSecurity.Repository channels for connection object lifecycle events
- Monitor Windows Security Event ID 4688 process creation events for Qlik service account activity
- Alert on first-seen executables launched by Qlik Sense services and integrate findings with the SIEM for correlation
How to Mitigate CVE-2024-55579
Immediate Actions Required
- Upgrade Qlik Sense Enterprise for Windows to November 2024 IR or apply the corresponding patch for your release train
- Audit existing connection objects and remove any that reference arbitrary executables not required for business operations
- Restrict Qlik Sense user roles so that only trusted administrators can create or edit connection objects
Patch Information
Qlik has released fixes in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. Patch downloads and release notes are available through the Qlik Support Security Fixes advisory.
Workarounds
- Limit network access to the Qlik Sense services so that only trusted users and segments can authenticate
- Run the Qlik Sense service account with the least privilege required and remove unnecessary local administrative rights
- Apply application allowlisting on the Qlik Sense host to block execution of unapproved binaries launched by service processes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
