CVE-2024-55580: Qlik Sense Enterprise RCE Vulnerability

CVE-2024-55580 Overview

CVE-2024-55580 is a code injection vulnerability (CWE-94) discovered in Qlik Sense Enterprise for Windows that allows unprivileged users with network access to execute remote commands. This vulnerability poses significant risks to data integrity and confidentiality, potentially enabling attackers to compromise enterprise business intelligence systems without requiring authentication.

Critical Impact

Unprivileged users with network access can execute remote commands, causing high availability damages including significant integrity and confidentiality risks to Qlik Sense Enterprise deployments.

Affected Products

• Qlik Sense Enterprise for Windows versions before November 2024 IR
• Qlik Sense Enterprise for Windows versions before May 2024 Patch 10
• Qlik Sense Enterprise for Windows versions before February 2024 Patch 14
• Qlik Sense Enterprise for Windows versions before November 2023 Patch 16
• Qlik Sense Enterprise for Windows versions before August 2023 Patch 16
• Qlik Sense Enterprise for Windows versions before May 2023 Patch 18
• Qlik Sense Enterprise for Windows versions before February 2023 Patch 15

Discovery Timeline

• 2024-12-09 - CVE-2024-55580 published to NVD
• 2024-12-10 - Last updated in NVD database

Technical Details for CVE-2024-55580

Vulnerability Analysis

This vulnerability stems from improper code injection controls (CWE-94) within Qlik Sense Enterprise for Windows. The flaw allows unprivileged users who have network access to the application to inject and execute arbitrary commands remotely. The attack requires user interaction and has high attack complexity, but successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability is particularly concerning for enterprise environments where Qlik Sense serves as a critical business intelligence platform, potentially exposing sensitive analytical data and business metrics to unauthorized access or manipulation.

Root Cause

The root cause of CVE-2024-55580 is a code injection vulnerability (CWE-94) where the application fails to properly sanitize or validate user-supplied input before processing it in a way that allows command execution. This insufficient input validation enables attackers to inject malicious code that gets executed within the context of the Qlik Sense Enterprise application.

Attack Vector

The attack is network-based, requiring the attacker to have network access to the vulnerable Qlik Sense Enterprise for Windows installation. While the attacker does not need authentication or special privileges, the attack has high complexity and requires some form of user interaction to succeed. Upon successful exploitation, the attacker can execute remote commands that may lead to unauthorized data access, data modification, or service disruption.

The vulnerability manifests through improper handling of user input that allows code injection. Attackers with network access can craft malicious requests that, when processed by the vulnerable Qlik Sense components, result in arbitrary command execution. For detailed technical information, refer to the Qlik Support Article on CVEs.

Detection Methods for CVE-2024-55580

Indicators of Compromise

• Unexpected or anomalous command execution processes spawned by Qlik Sense services
• Unusual network connections originating from Qlik Sense Enterprise servers to external or internal addresses
• Suspicious entries in Qlik Sense application logs indicating code injection attempts
• Unauthorized changes to Qlik Sense configuration files or data stores

Detection Strategies

• Monitor Qlik Sense Enterprise process activity for child processes that indicate command execution
• Implement network traffic analysis to detect anomalous outbound connections from Qlik Sense servers
• Deploy endpoint detection and response (EDR) solutions to identify suspicious behavior patterns
• Review application logs for indicators of injection attempts or exploitation activity

Monitoring Recommendations

• Enable comprehensive logging on Qlik Sense Enterprise installations
• Configure alerting for unusual process creation events on Qlik Sense servers
• Implement network segmentation and monitor traffic to and from Qlik Sense deployments
• Regularly audit user access and activity within the Qlik Sense environment

How to Mitigate CVE-2024-55580

Immediate Actions Required

• Identify all Qlik Sense Enterprise for Windows installations in your environment
• Verify current patch levels against the fixed versions listed in the security advisory
• Prioritize patching internet-facing or externally accessible Qlik Sense deployments
• Implement network access controls to limit exposure while patches are applied

Patch Information

Qlik has released security patches to address this vulnerability. Organizations should upgrade to one of the following fixed versions:

• November 2024 IR - Latest recommended version
• May 2024 Patch 10
• February 2024 Patch 14
• November 2023 Patch 16
• August 2023 Patch 16
• May 2023 Patch 18
• February 2023 Patch 15

For detailed patching instructions and download links, consult the Qlik Support Article on CVEs.

Workarounds

• Restrict network access to Qlik Sense Enterprise servers using firewall rules and network segmentation
• Implement strict access controls to limit which users can reach the Qlik Sense environment
• Deploy a web application firewall (WAF) to filter potentially malicious requests
• Monitor for exploitation attempts while patches are being deployed

# Example: Restrict network access to Qlik Sense ports using Windows Firewall
# Limit access to trusted IP ranges only
netsh advfirewall firewall add rule name="Restrict Qlik Sense Access" dir=in action=allow protocol=TCP localport=443 remoteip=10.0.0.0/8
netsh advfirewall firewall add rule name="Block Qlik Sense External" dir=in action=block protocol=TCP localport=443 remoteip=any